CVE-2026-54571: ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores boundaryPosition as an 8-bit value while parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ESPAsyncWebServerto a version that resolves this vulnerability.Fixed in 3.11.1
Event History
Frequently Asked Questions
Which deployments are affected?
ESP32 and ESP8266 devices using ESPAsyncWebServer versions before 3.11.1 are affected. The provided information does not identify impact on RP2040 or RP2350 devices.
What must an attacker be able to do?
An attacker must be able to send a remote multipart/form-data request to the server with an exactly 256-byte multipart boundary. Successful triggering consumes excessive CPU and causes a FreeRTOS watchdog reset on affected devices.
How can I determine whether remediation is needed?
Check the ESPAsyncWebServer version used in the device build. Versions earlier than 3.11.1 should be updated to version 3.11.1.