Multipart Boundary Parsing Vulnerability in ESPAsyncWebServer Library

CVE-2026-54571

What is CVE-2026-54571?

The ESPAsyncWebServer library, designed for ESP32 and ESP8266, contains a vulnerability in its multipart/form-data parser prior to version 3.11.1. The issue arises when the parser processes multipart requests featuring a 256-byte boundary. This causes the boundary position to wrap around from 255 to zero, creating an infinite loop in the boundary parsing mechanism. As a result, affected devices may experience excessive CPU consumption and trigger a FreeRTOS watchdog reset. Users are advised to upgrade to version 3.11.1 or later to mitigate this vulnerability.

References