ESP32Async ESPAsyncWebServer up to 3.11.0 Multipart/Form-Data Parser src/WebRequest.cpp _parseMultipartPostByte integer overflow

Summaryinfo

A vulnerability categorized as problematic has been discovered in ESP32Async ESPAsyncWebServer up to 3.11.0. Affected is the function _parseMultipartPostByte of the file src/WebRequest.cpp of the component Multipart/Form-Data Parser. Executing a manipulation can lead to integer overflow. The identification of this vulnerability is CVE-2026-54571. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in ESP32Async ESPAsyncWebServer up to 3.11.0. It has been declared as problematic. This vulnerability affects the function _parseMultipartPostByte of the file src/WebRequest.cpp of the component Multipart/Form-Data Parser. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect availability. CVE summarizes:

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.

The advisory is available at github.com. This vulnerability was named CVE-2026-54571 since 06/15/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 3.11.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Server

Vendor

• ESP32Async

Name

• ESPAsyncWebServer

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11.0

Website

• Product: https://github.com/ESP32Async/ESPAsyncWebServer/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion