Espasyncwebserver
Approved changes feed: RSS · Atom
cpe:2.3:a:esp32async:espasyncwebserver:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Esp32Async (96acc040-8f3f-535b-a8e9-8758f3e3c72d) |
|---|---|
| Product | Espasyncwebserver (0fba00a8-b84f-5835-ab9c-148ed7a30761) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54571 |
vulnerable | 2026-10-13 12:29:14.208983 |
ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.
Published: 2026-09-17T18:28:26.977Z
Updated: 2026-09-21T21:05:49.373Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53094 |
vulnerable | 2026-06-08 07:31:13.933179 |
ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP headers within `AsyncWebHeader.cpp`. Unsanitized input allows attackers to inject CR (`\r`) or LF (`\n`) characters into header names or values, leading to arbitrary header or response manipulation. Manipulation of HTTP headers and responses can enable a wide range of attacks, making the severity of this vulnerability high. A fix is available at pull request 211 and is expected to be part of version 3.7.9.
Published: 2025-06-27T19:57:15.032Z
Updated: 2025-06-27T20:19:14.457Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.