arduino-esp32 vulnerabilities

6 known vulnerabilities in arduino-esp32 from Espressif. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  arduino-esp32: Improper Authentication

  CVE-2026-42855May 12, 2026Espressif

  arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from

• 9.8 Critical severity

  arduino-esp32: Stack-based Buffer Overflow

  CVE-2026-42854May 12, 2026Espressif

  arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a Variable Length Array (VLA) on the stack whose size is derive

• 8.8 High severity

  arduino-esp32: Stack-based Buffer Overflow

  CVE-2026-41429Apr 24, 2026Espressif

  arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBN

• 8.7 High severity

  arduino-esp32: Cross-Site Request Forgery

  CVE-2025-53540Jul 7, 2025Espressif

  arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPUpdateServer implementation are vulnerable to Cross-Site Request Forgery (CSRF). The update endpoints

• 8.9 High severity

  arduino-esp32: Improper Neutralization of CRLF Sequences in HTTP Headers

  CVE-2025-53007Jun 26, 2025Espressif

  arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` function takes arbitrary input for the HTTP header name and value, concatenates them into an HTTP head

• 9.9 Critical severity

  arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and…

  CVE-2024-45798Sep 17, 2024Espressif

  arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` work