high · CVSS v3 7.5 · CVSS v4 8.7
CVE-2026-54571
ESPAsyncWebServer prior to version 3.11.1 contains a denial-of-service vulnerability in its multipart/form-data parser. An unauthenticated a
Overview
ESPAsyncWebServer prior to version 3.11.1 contains a denial-of-service vulnerability in its multipart/form-data parser. An unauthenticated attacker can send a crafted HTTP request with a 256-byte boundary to trigger an integer wrap-around condition. This results in an infinite loop that consumes excessive CPU resources and forces a watchdog reset on microcontrollers.
Description
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
Impact
The vulnerability directly impacts availability by causing system reboots and service disruptions on vulnerable embedded devices. Confidentiality and integrity are not affected, but the continuous resetting prevents legitimate users from accessing the web or WebSocket server. IoT device administrators and embedded systems engineers managing connected microcontrollers are affected.
Remediation
Update the ESPAsyncWebServer library to version 3.11.1 or later where the boundary position storage variable has been corrected. If updating immediately is not possible, restrict network access to the web server interface using firewalls or network segmentation, and consider implementing input validation filters at a reverse proxy if applicable.
Risk context
The vulnerability carries a CVSS v4 score of 8.7 and a CVSS v3 score of 7.5, classifying it as high severity due to the ease of remote denial of service against exposed embedded systems. EPSS data is currently unavailable, but defenders should prioritize patching given the public nature of the flaw and the critical impact on device uptime.
Affected products
- ESPAsyncWebServer < 3.11.1
- ESP32
- ESP8266
- RP2040
- RP2350
Scores
- Severity
- high
- CVSS v2
- 5
- CVSS v3
- 7.5
- CVSS v4
- 8.7
- EPSS
- —