ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.
Summary
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ESP32Async | ESPAsyncWebServer | before 3.11.1 | 3.11.1 | Patch available | CNA |
- ESPAsyncWebServer VendorESP32Async Affected before 3.11.1 Fixed in 3.11.1 Patch available CNA
Remediation
- Fix · CNA ESPAsyncWebServer (ESP32Async) Fixed in 3.11.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54571
References
Other 4
- https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-4phx-fcj6-46r4
- https://github.com/ESP32Async/ESPAsyncWebServer/pull/445
- https://github.com/ESP32Async/ESPAsyncWebServer/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f
- https://github.com/ESP32Async/ESPAsyncWebServer/releases/tag/v3.11.1
More ESP32Async vulnerabilities
- TI-2025-33087 ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp CVSS 4.0HIGH 8.7
- TI-2026-83405 NULL pointer write in ESPAsyncWebServer multipart parser CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences