EUVD-2026-82385Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device HTTP endpoint on network
-
DeliverySend POST with 256-byte multipart boundary
-
Exploituint8_t _boundaryPosition wraps 255→0
-
ExecutionBoundary parse loop never terminates
-
PersistCPU exhaustion trips FreeRTOS watchdog
-
ImpactDevice resets / offline
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or user interaction required (PR:N/UI:N/AC:L). The specific prerequisite is that the target ESP32/ESP8266/RP2040/RP2350 device runs ESPAsyncWebServer prior to 3.11.1 AND handles multipart/form-data POST requests (typically a file-upload or form-handling endpoint), because the flaw is in the multipart boundary parser. The concrete trigger is a Content-Type header whose multipart boundary parameter is exactly 256 bytes, wrapping the 8-bit _boundaryPosition counter. Limiting factors: the attacker must be able to route an HTTP request to the device (many such devices sit on LANs/segmented IoT networks rather than the public internet), and the impact is limited to a device reset/hang - no code execution or data disclosure. |
| Impact | This is a genuine, straightforward denial-of-service risk against internet/network-reachable IoT devices. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) is internally consistent with the description: a remote, unauthenticated attacker sends a single crafted HTTP request with no user interaction and no special attack requirements, and the only impact is availability (a FreeRTOS watchdog reset). There is NO confidentiality or integrity impact, so the 8.7 'High' rating is driven entirely by the ease of a full-device reboot/hang, not by data exposure - the 'Information Disclosure' tag contradicts the vector (VC:N) and appears to be a mislabel. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; however, the advisory and commit describe the trigger with unusual precision (an exactly 256-byte multipart boundary overflowing a uint8_t counter), which lowers the effort to reproduce. Net: real priority for exposed ESP32/ESP8266 devices that accept multipart uploads, but the impact ceiling is a reboot/hang rather than code execution or data loss. |
| Exploit ScenarioDerived | An attacker who can reach the device's HTTP endpoint sends a POST request with Content-Type multipart/form-data whose boundary parameter is exactly 256 bytes long. The 8-bit _boundaryPosition counter wraps from 255 to 0, the boundary-parsing loop never terminates, CPU is pinned, and the FreeRTOS watchdog resets the ESP32/ESP8266, taking the device offline; repeating the request keeps it in a reboot loop. No public exploit code was identified, but the advisory documents the exact trigger condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Denial of service in ESPAsyncWebServer (all versions prior to 3.11.1) lets an unauthenticated remote attacker hang or reset ESP32, ESP8266, RP2040, and RP2350 devices by sending a multipart/form-data POST whose boundary parameter is exactly 256 bytes long, which wraps the 8-bit _boundaryPosition counter to zero and traps the boundary-parsing loop in an endless spin until the FreeRTOS task watchdog fires. Exploitation requires no credentials and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U with A:H), but the device must be network-reachable and must expose an endpoint that accepts multipart POSTs, such as a file-upload or form handler; many such devices sit on isolated LANs, which limits practical exposure. At time of analysis there was no CISA KEV entry and no public exploit code identified, and the impact is confined to a device reset or hang - no code execution, data disclosure, or persistence.
RemediationAI
Upgrade ESPAsyncWebServer to version 3.11.1 or later, which is the vendor-released patch containing the widened size_t counter plus the explicit rejection of boundaries that are empty or exceed 70 characters (see the release notes at https://github.com/ESP32Async/ESPAsyncWebServer/releases/tag/v3.11.1, the advisory at https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-4phx-fcj6-46r4, and the fix in commit b928de7cbd7debcd6266ece6a6c46f10a86d3a6f / PR #445). Because this is a library rather than a standalone service, patching means updating the dependency in each firmware project and reflashing every deployed device; audit your build for transitive or vendored copies, since PlatformIO/Arduino dependency pins are easy to miss. If immediate reflashing is not feasible, place the affected devices behind a reverse proxy or API gateway that enforces a maximum Content-Type header length (reject boundaries over roughly 70 characters) and caps multipart body size - note this adds configuration overhead and can break legitimate large file-uploads if the limit is set too low. Disabling or removing multipart POST endpoints from untrusted networks removes the attack surface entirely but also disables OTA and form-based configuration, which may be operationally unacceptable. Restricting device management interfaces to a segmented VLAN or VPN and blocking their HTTP ports from the internet and from general-purpose client networks is a complementary compensating control that does not require firmware changes. As with most embedded DoS fixes, physical recovery may be needed after a successful trigger, so prioritize patching internet- or guest-network-reachable devices first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190 (Integer Overflow or Wraparound) in the multipart/form-data parser of src/WebRequest.cpp. AsyncWebServerRequest declared _boundaryPosition as uint8_t, and _parseMultipartPostByte increments it while scanning incoming body bytes for the MIME boundary delimiter. Because the counter can only hold 0-255, a boundary string of exactly 256 bytes causes the counter to overflow from 255 back to 0 at the precise moment the parser should have matched the final byte, so the BOUNDARY_OR_DATA state machine never reaches its terminating condition and loops indefinitely, burning CPU until the ESP32/ESP8266 FreeRTOS watchdog resets the chip. RFC 2046 section 5.1 caps boundary strings at 70 characters, so lengths near 256 are non-conformant but were previously accepted by the library. The upstream fix (commit b928de7cbd7debcd6266ece6a6c46f10a86d3a6f, PR #445) widens _boundaryPosition from uint8_t to size_t, rejects boundaries that are empty or longer than 70 characters before parsing begins, and hardens the surrounding header handling - case-insensitive and quote-aware boundary extraction, plus corrected RFC 7230 OWS (optional whitespace) stripping in AsyncWebHeader::parse. No CPE strings were supplied in the input data, so exact platform CPEs for the embedded Arduino/PlatformIO ecosystems are not enumerated here; the affected software is the ESPAsyncWebServer library itself rather than a downstream firmware image.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, single crafted request with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is a device watchdog reset only, so A:H with C:N/I:N.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
Technical POC Analysis
CWE-190 integer overflow/wraparound, in the multipart/form-data parser of ESPAsyncWebServer, file src/WebRequest.cpp, function parseMultipartPostByte.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ESPAsyncWebServer, an embedded web-server library used across ESP32, ESP8266, RP2040 and RP2350 microcontroller products, can be remotely hung or forced to reboot by a single unauthenticated HTTP request, knocking affected devices offline until they recover. Because the flaw is a straightforward denial-of-service and requires no credentials or user interaction, any network-reachable device exposing a file-upload, form or OTA endpoint - including fielded sensors, controllers and connected consumer hardware - is a candidate for repeated disruption. Leadership should care because the exposure is availability-only (no code execution, data loss or persistence) and is largely confined to devices reachable on a network segment, but unpatched fleets can be cycled offline at will by anyone who can reach them.
No vendor-released patch was identified at time of analysis; interim mitigations are to disable or block multipart/form-data POST endpoints (file upload, form and OTA handlers) on affected devices, restrict device management and upload interfaces to trusted or isolated network segments via firewall/VLAN rules, place a reverse proxy or rate limiter in front of any internet-reachable device, and enable or shorten watchdog-based auto-recovery so a hung task returns to service. Where a build path exists, upgrading the bundled library to 3.11.1 removes the condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Exploit-DB