CVE-2026-42855
HighSummary
In versions prior to 3.3.8, the Digest authentication implementation in arduino-esp32 computed the authentication hash using the URI field from the client's Authorization header, without verifying that it matched the actual requested URI. This allows an attacker to authenticate requests to a different protected URI, bypassing access control.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to data leakage or system integrity breaches.
Recommendation
It is recommended to upgrade to version 3.3.8 or later to mitigate this vulnerability and implement additional access control mechanisms.
Other vulnerabilities in arduino-esp32
See all- CVE-2026-41429High
In versions prior to 3.3.8, the arduino-esp32 library has a memory corruption issue in the NBNS packet handling. When NetBIOS is enabled, the device listens on UDP port 137 and processes untrusted NBNS requests from the local network.
- CVE-2026-42854Critical
In versions prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derived from an attacker-controlled HTTP header field. Sending a boundary string longer than ~8000 characters overflows the stack and may lead to remote code execution.
Original NVD description (English source)
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.