Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54571— ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service

Quick assessment

Affected
ESP32Async ESPAsyncWebServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESPAsyncWebServer 是一款用于 ESP32、ESP8266、RP2040 和 RP2350 的异步 HTTP 和 WebSocket 服务器库。在版本 3.11.1 之前， 中的 解析器将 存储为一个 8 位值，而 函数在处理边界（boundary）时使用该值。如果一个远程请求中包含一个恰好为 256 字节的 边界， 会从 255 回绕（wrap around）到 0，导致边界解析循环无法终止，从而消耗大量 CPU 资源，并在受影响的 ESP32 或 ESP8266 设备上触发 FreeRTOS 看

CVSS 8.7 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
ESP32Async ESPAsyncWebServer < 3.11.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54571

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ESP32Async ESPAsyncWebServer < 3.11.1 -

II. Public POCs for CVE-2026-54571

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54571

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54571 (2)

Vendor Advisories for CVE-2026-54571 (1)

Vendor Pages for CVE-2026-54571 (1)

IV. Related Vulnerabilities

Same product: ESPAsyncWebServer
Same vendor: ESP32Async
Same weakness: CWE-190

V. Comments for CVE-2026-54571

No comments yet

Leave a comment