ESP32Async ESPAsyncWebServer up to 3.7.8 on ESP32/ESP8266/RP2040/RP2350 HTTP Header AsyncWebHeader.cpp crlf injection

Summaryinfo

A vulnerability classified as problematic was found in ESP32Async ESPAsyncWebServer up to 3.7.8 on ESP32/ESP8266/RP2040/RP2350. This affects an unknown function of the file AsyncWebHeader.cpp of the component HTTP Header Handler. Such manipulation leads to crlf injection. This vulnerability is referenced as CVE-2025-53094. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in ESP32Async ESPAsyncWebServer up to 3.7.8 on ESP32/ESP8266/RP2040/RP2350. Affected by this issue is an unknown function of the file AsyncWebHeader.cpp of the component HTTP Header Handler. The manipulation with an unknown input leads to a crlf injection vulnerability. Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Impacted is integrity. CVE summarizes:

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP headers within `AsyncWebHeader.cpp`. Unsanitized input allows attackers to inject CR (`\r`) or LF (`\n`) characters into header names or values, leading to arbitrary header or response manipulation. Manipulation of HTTP headers and responses can enable a wide range of attacks, making the severity of this vulnerability high. A fix is available at pull request 211 and is expected to be part of version 3.7.9.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-53094 since 06/25/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19427). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• ESP32Async

Name

• ESPAsyncWebServer

Version

• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8

Website

• Product: https://github.com/ESP32Async/ESPAsyncWebServer/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion