Executive brief
ESPAsyncWebServer is an HTTP and WebSocket server library used in IoT devices including ESP32 and ESP8266 microcontrollers. A remote attacker can craft a malicious HTTP request with a 256-byte multipart boundary to trigger an infinite parsing loop that consumes 100% CPU and crashes the device, causing a denial of service to any applications or services relying on the affected firmware.
Technical details
The vulnerability is an integer overflow (CWE-190) in the multipart/form-data parser in src/WebRequest.cpp. The _boundaryPosition variable is declared as an 8-bit unsigned integer (uint8_t), which can only represent values 0–255. When a remote attacker sends a Content-Type header with a multipart boundary string of exactly 256 bytes, the increment operation in _parseMultipartPostByte() overflows back to zero, causing the parser to loop indefinitely in the BOUNDARY_OR_DATA state. The attack requires no authentication and is network-reachable. The fix, released in version 3.11.1, changes _boundaryPosition from uint8_t to size_t to eliminate the overflow and adds boundary validation to reject boundaries longer than 70 bytes per RFC 2046.
Affected products
- ESP32Async ESPAsyncWebServer before 3.11.1
Timeline
- 2026-09-17: disclosed
- 2026-06-08: patched: Version 3.11.1 released with fix