mDNS Component Vulnerability in ESP-IDF Affects Espressif Devices

CVE-2026-64860

What is CVE-2026-64860?

The mDNS component in ESP-IDF, prior to version 1.11.2, is susceptible to a stack exhaustion vulnerability due to its handling of DNS name-compression pointers in fully qualified domain names (FQDNs) within inbound mDNS packets. This weakness enables an unauthenticated attacker on the same link-local network to exploit the mDNS service by sending maliciously crafted packets to UDP port 5353, potentially causing a controlled panic and reboot of the device. Continuous malicious traffic can lead to a recurring crash loop. Although this vulnerability does not impact confidentiality or integrity, it poses significant operational risks. The issue has been addressed in mDNS version 1.11.2.

References