CVE-2026-62966

HighCVSS 7.5

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

37th percentile - higher than 37% of all known CVEs

Summary

ESPAsyncWebServer before version 3.11.2 has a flaw in the multipart parser where it frees a buffer and sets it to NULL but still writes through the NULL pointer. This occurs when the byte after a file part boundary is not a valid terminator, causing a StoreProhibited exception and device reboot. The vulnerability requires a route with file upload or OTA handling.

Risk Assessment

A remote attacker can trigger a panic and reboot of the ESP32 device, causing denial of service. This affects devices with active upload or web-OTA endpoints.

Recommendation

Update ESPAsyncWebServer to version 3.11.2 or later. If updating is not possible, restrict access to file upload and OTA endpoints.

Other vulnerabilities in ESPAsyncWebServer

CVE-2026-54571High
In ESPAsyncWebServer (an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350) before version 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. The issue is fixed in version 3.11.1.

Original NVD description (English source)

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS