CVE-2026-64860— espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression

Quick assessment

Affected

espressif esp-protocols

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESP-Protocols 是 ESP-IDF 的协议组件集合。在 mDNS 组件版本 1.11.2 之前，该组件在解析入站 mDNS 数据包中的完全限定域名（FQDN）时，会在函数中递归跟随 DNS 名称压缩指针，且未对指针跟随深度设置上限。同一链路本地网络中的未认证攻击者可以向启用了组件的 ESP-IDF 设备，向其 UDP 5353 端口发送精心构造的数据包。过深的递归会耗尽 mDNS FreeRTOS 任务中固定大小的栈空间，导致受控的恐慌（panic）并触发设备重启；若持续发送恶意流量，则可能引发崩溃

CVSS 6.5 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
espressif	esp-protocols	`< 1.11.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression

Source: CVE Program / CVE List V5

Vulnerability Description

ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in `mdns_utils_read_fqdn()`. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an `ESP-IDF` device using `espressif/mdns` with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
espressif	esp-protocols	< 1.11.2	-

II. Public POCs for CVE-2026-64860

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-64860

请登录查看更多情报信息。

Other References for CVE-2026-64860 (3)

https://github.com/espressif/esp-protocols/releases/tag/mdns-v1.11.2 x_refsource_MISC
https://github.com/espressif/esp-protocols/security/advisories/GHSA-7fpr-vjw5-2c86 x_refsource_CONFIRM
https://github.com/espressif/esp-protocols/commit/95c882c7d7d661d28d4685bd052b024154a8402f x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-64860

IV. Related Vulnerabilities

Same vendor: espressif

Same weakness: CWE-400