Espasyncwebserver
Monthly
Remote denial of service in ESPAsyncWebServer (all versions prior to 3.11.2, i.e. up to and including 3.11.1) lets an unauthenticated remote attacker reboot an affected ESP32 device by sending a single malformed multipart/form-data request to a route that has a non-trivial body handler, such as a file-upload or web-OTA endpoint. The multipart parser frees and NULLs the file-item buffer the instant it matches the closing '--<boundary>' but leaves the file flag set, so when the next byte is neither the final '--' nor a clean CRLF the rewind logic writes through the NULL pointer, triggering a StoreProhibited exception, panic and device reboot. The flaw is fixed in 3.11.2; there is no CISA KEV entry and no confirmed working exploit code, although the vendor advisory publishes a public curl reproducer that is not verified as weaponized exploit code.
Remote denial of service in ESPAsyncWebServer (all versions prior to 3.11.2, i.e. up to and including 3.11.1) lets an unauthenticated remote attacker reboot an affected ESP32 device by sending a single malformed multipart/form-data request to a route that has a non-trivial body handler, such as a file-upload or web-OTA endpoint. The multipart parser frees and NULLs the file-item buffer the instant it matches the closing '--<boundary>' but leaves the file flag set, so when the next byte is neither the final '--' nor a clean CRLF the rewind logic writes through the NULL pointer, triggering a StoreProhibited exception, panic and device reboot. The flaw is fixed in 3.11.2; there is no CISA KEV entry and no confirmed working exploit code, although the vendor advisory publishes a public curl reproducer that is not verified as weaponized exploit code.