{"id":"CVE-2026-54571","summary":"ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service","details":"ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.","aliases":["GHSA-4phx-fcj6-46r4"],"modified":"2026-09-19T08:08:54.132132Z","published":"2026-09-17T18:28:26.977Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54571.json"},"references":[{"type":"WEB","url":"https://github.com/ESP32Async/ESPAsyncWebServer/releases/tag/v3.11.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54571.json"},{"type":"ADVISORY","url":"https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-4phx-fcj6-46r4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54571"},{"type":"FIX","url":"https://github.com/ESP32Async/ESPAsyncWebServer/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f"},{"type":"FIX","url":"https://github.com/ESP32Async/ESPAsyncWebServer/pull/445"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/esp32async/espasyncwebserver","events":[{"introduced":"0"},{"fixed":"b928de7cbd7debcd6266ece6a6c46f10a86d3a6f"},{"fixed":"d6aa7daf0823a41966b1841826cff015237d6e42"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.11.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.11.0","v3.10.3","v3.10.2","v3.10.1","v3.10.0","v3.9.6","v3.9.5","v3.9.4","v3.9.3","v3.9.2","v3.9.1","v3.9.0","v3.8.1","v3.8.0","v3.7.10","v3.7.9","v3.7.8","v3.7.7","v3.7.6","v3.7.5","v3.7.4","v3.7.3","v3.7.2","v3.7.1","v3.7.0","v3.6.2","v3.6.1","v3.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54571.json","vanir_signatures_modified":"2026-09-19T08:08:54Z","vanir_signatures":[{"digest":{"function_hash":"13482258073792757512769263519243303456","length":5842},"id":"CVE-2026-54571-353fb0c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/esp32async/espasyncwebserver/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f","target":{"file":"src/WebRequest.cpp","function":"AsyncWebServerRequest::_parseMultipartPostByte"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/esp32async/espasyncwebserver/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f","target":{"file":"src/WebRequest.cpp"},"deprecated":false,"digest":{"line_hashes":["50373655993277274044199804114146214996","277084077113805774990828230464771742729","177230807398313582508751020137696124183","6382743880197948956787322467786014876","175887762751632762438004531304534527462","160813468018945430188320157820538318237","87940679097762125727336016132028285899","258119031396002688888719040977670610593","157070623819866687843049459629543102431","211897997287216282861165377467592382619","113783488803998475557262035171152257618","218733862052613370882899920632968760243","261785772783712007940537554991273134076","334770614427203681421527133369187577974","184442360700426762925240948265532135455","113783488803998475557262035171152257618","199425783068218587890104671044734003565","170405027821196455923272318713928265655","295905245037203755785635523673772451474","6517962458437896774214013780797971263","113783488803998475557262035171152257618","199425783068218587890104671044734003565","170405027821196455923272318713928265655","295905245037203755785635523673772451474","133666858893455353028045781046169008985"],"threshold":0.9},"id":"CVE-2026-54571-7f72fc7c"},{"id":"CVE-2026-54571-8d30baad","signature_type":"Line","signature_version":"v1","source":"https://github.com/esp32async/espasyncwebserver/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f","target":{"file":"src/AsyncWebHeader.cpp"},"deprecated":false,"digest":{"line_hashes":["53617482158614095000469298562947025538","330354637395252109980629203053293509051","157691146760508153941528935054079246272","23168987925312077724955972372407312502"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["164532708359007570946852146287590180867","325166482005093115117990979217997171338","314861905119774255776474164118202823812","294001974406523400347141112912564824389"],"threshold":0.9},"id":"CVE-2026-54571-a7e33557","signature_type":"Line","signature_version":"v1","source":"https://github.com/esp32async/espasyncwebserver/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f","target":{"file":"src/literals.h"}},{"digest":{"function_hash":"114959611815535272178301195977827683490","length":2620},"id":"CVE-2026-54571-b9399db7","signature_type":"Function","signature_version":"v1","source":"https://github.com/esp32async/espasyncwebserver/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f","target":{"file":"src/WebRequest.cpp","function":"AsyncWebServerRequest::_parseReqHeader"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"275589810711594445803467100841967522835","length":559},"id":"CVE-2026-54571-c3a1e882","signature_type":"Function","signature_version":"v1","source":"https://github.com/esp32async/espasyncwebserver/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f","target":{"file":"src/AsyncWebHeader.cpp","function":"AsyncWebHeader::parse"}},{"id":"CVE-2026-54571-d936ed2f","signature_type":"Line","signature_version":"v1","source":"https://github.com/esp32async/espasyncwebserver/commit/b928de7cbd7debcd6266ece6a6c46f10a86d3a6f","target":{"file":"src/ESPAsyncWebServer.h"},"deprecated":false,"digest":{"line_hashes":["214502188088267827139264476486928335906","294685448859595136303373488255166790305","288385968256443677373018772827145228973","55886502724665761818865250282904923637"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}