CyberRota Analysis
AI-GeneratedThe multipart/form-data parser in the ESPAsyncWebServer library for ESP32 and ESP8266 devices is vulnerable to a denial-of-service attack due to improper handling of 256-byte multipart boundaries, which can lead to excessive CPU consumption and FreeRTOS watchdog resets. This vulnerability affects versions prior to 3.11.1 and should be prioritized by developers and system administrators using these devices in critical applications to ensure system stability and availability. Immediate upgrading to version 3.11.1 or later is recommended to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.