ESP32Async vulnerabilities
We track 3 vulnerabilities in ESP32Async products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest ESP32Async vulnerabilities
- 7.5 High severity
ESPAsyncWebServer: NULL Pointer Dereference
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the clos
- 8.7 High severity
ESPAsyncWebServer: Integer Overflow or Wraparound
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte process
- 8.7 High severity
ESPAsyncWebServer: Improper Neutralization of CRLF Sequences
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP header