CVE-2026-54571 in ESPAsyncWebServer
Summary
by MITRE • 09/17/2026
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the ESPAsyncWebServer library prior to version 3.11.1 represents a critical integer overflow flaw embedded in the multipart/form-data parsing logic, specifically affecting microcontroller platforms such as the ESP32, ESP8266, RP2040, and RP2350. This asynchronous HTTP server is widely deployed in Internet of Things devices to handle web-based interactions, making its robustness essential for system stability. The core technical flaw resides in the src/WebRequest.cpp file, where the variable _boundaryPosition is declared as an 8-bit unsigned integer. During the processing of multipart POST requests via the _parseMultipartPostByte function, this variable tracks the current position within the data stream relative to the defined boundary string that separates different parts of a multipart message. Because an 8-bit unsigned integer has a maximum value of 255, any attempt to increment it beyond this limit results in an arithmetic overflow, causing the value to wrap around from 255 back to zero.
This integer overflow directly leads to a denial-of-service condition characterized by infinite looping and subsequent system reset. When a remote attacker submits a multipart/form-data request containing a boundary string that is exactly 256 bytes long, the parsing logic attempts to scan for this boundary within the incoming data stream. As the parser iterates through the data, it increments _boundaryPosition with each byte processed. Upon reaching the 256th byte relative to the start of the boundary search, the variable overflows and resets to zero. This reset causes the internal state machine responsible for detecting the end of a multipart part to fail in recognizing that the boundary has been fully matched or passed. Consequently, the parsing loop does not terminate as intended but instead continues indefinitely, consuming CPU cycles at maximum capacity without making further progress toward completing the request processing.
The operational impact of this vulnerability is severe for resource-constrained embedded systems running FreeRTOS. The infinite loop caused by the integer overflow monopolizes the processor core, preventing other tasks from executing and effectively freezing the device's functionality. In environments where watchdog timers are configured to monitor system health, the prolonged unresponsiveness triggers a hardware or software reset mechanism designed to recover from hangs. This results in a repeated cycle of denial-of-service followed by automatic rebooting, which can lead to data loss, service interruption, and potential instability if critical background tasks such as sensor readings or network keep-alives are disrupted during the freeze. The vulnerability is exploitable remotely over HTTP without requiring authentication, making it particularly dangerous for devices exposed directly to untrusted networks.
From a classification perspective, this issue aligns with CWE-190, which describes integer overflow or wraparound vulnerabilities that can lead to unexpected behavior such as infinite loops or buffer overflows. Furthermore, the exploitation technique falls under MITRE ATT&CK tactic T1499, specifically Endpoint Denial of Service via resource exhaustion, where an attacker leverages a software flaw to consume system resources until availability is compromised. The lack of proper bounds checking on array indices and loop counters in embedded C/C++ codebases is a common precursor to such flaws, highlighting the need for rigorous static analysis during development.
Mitigation strategies primarily involve upgrading the ESPAsyncWebServer library to version 3.11.1 or later, where this integer overflow has been corrected by utilizing appropriate data types that can handle larger boundary lengths without wrapping. For systems unable to immediately update due to dependency constraints, implementing a reverse proxy such as Nginx in front of the microcontroller device is recommended. The reverse proxy can be configured with strict limits on request body size and multipart field sizes, effectively filtering out maliciously crafted requests before they reach the vulnerable application layer. Additionally, developers should enforce input validation at the network edge to ensure that incoming HTTP headers do not contain excessively long boundary strings, thereby reducing the attack surface available to potential adversaries targeting embedded web services.