Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-54571

ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service

CVSS 4.0 8.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-54571

Published

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-54571

Published

ESPAsyncWebServer

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ESP32Async",
                    "product": "ESPAsyncWebServer",
                    "versions": [
                        {
                            "version": "< 3.11.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON