{"id":"CVE-2026-62966","title":"ESPAsyncWebServer multipart parser has null-pointer write","summary":"ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-476","CWE-672"],"vendor":"ESP32Async","product":"ESPAsyncWebServer","affected":["ESPAsyncWebServer < 3.11.2"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-06T18:20:37.577657Z"},"published":"2026-10-30","updated":"2026-11-06","sourceUpdated":"2026-11-06T18:21:46.069Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62966","references":[{"url":"https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-8m8p-vhxc-jmjw","label":"https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-8m8p-vhxc-jmjw"},{"url":"https://github.com/ESP32Async/ESPAsyncWebServer/commit/4efbd35e597d91f01749f2d4a14bb78fba8ea02e","label":"https://github.com/ESP32Async/ESPAsyncWebServer/commit/4efbd35e597d91f01749f2d4a14bb78fba8ea02e"},{"url":"https://github.com/ESP32Async/ESPAsyncWebServer/tree/v3.11.2","label":"https://github.com/ESP32Async/ESPAsyncWebServer/tree/v3.11.2"}],"tags":["cve.org"],"epss":0.00426,"epssPercentile":0.37144,"ingestedAt":"2026-11-05T16:24:31.464Z","slug":"CVE-2026-62966","body":"## Overview\n\nESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.\n\n## Affected\n\n- `ESPAsyncWebServer < 3.11.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}