CVE-2026-62966 Details
Description
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.
A NULL pointer dereference vulnerability has been identified in the ESPAsyncWebServer library, which is used for asynchronous HTTP and WebSocket server functionality on ESP32, ESP8266, RP2040, and RP2350. This vulnerability exists in versions through 3.11.1. The issue arises in the multipart parser within the file 'src/WebRequest.cpp'. When the parser matches the closing boundary of a file part, it frees the buffer holding the item data but fails to reset a flag indicating whether the item is a file. If the subsequent byte does not confirm the end of the boundary, the parser's rewind logic reintroduces the previously consumed bytes. Because the file flag remains set, this operation attempts to write to a null pointer, causing a 'StoreProhibited' exception on the ESP32, which leads to a device panic and reboot, creating a remote denial-of-service condition. The vulnerability can be triggered on a route that handles file uploads or web-OTA updates by sending a boundary string that coincidentally appears in the file data, followed by a byte that does not properly terminate the boundary,
Users can upgrade to ESPAsyncWebServer version 3.11.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-672 | Operation on a Resource after Expiration or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ESPAsyncWebServer | <= 3.11.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |