{"id":"CVE-2026-64860","title":"espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression","summary":"ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS pack…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-400","CWE-674"],"vendor":"espressif","product":"esp-protocols","affected":["esp-protocols < 1.11.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T17:27:02.630803Z"},"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T17:27:44.180Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64860","references":[{"url":"https://github.com/espressif/esp-protocols/security/advisories/GHSA-7fpr-vjw5-2c86","label":"https://github.com/espressif/esp-protocols/security/advisories/GHSA-7fpr-vjw5-2c86"},{"url":"https://github.com/espressif/esp-protocols/commit/95c882c7d7d661d28d4685bd052b024154a8402f","label":"https://github.com/espressif/esp-protocols/commit/95c882c7d7d661d28d4685bd052b024154a8402f"},{"url":"https://github.com/espressif/esp-protocols/releases/tag/mdns-v1.11.2","label":"https://github.com/espressif/esp-protocols/releases/tag/mdns-v1.11.2"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T22:38:31.437Z","slug":"CVE-2026-64860","body":"## Overview\n\nESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in `mdns_utils_read_fqdn()`. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an `ESP-IDF` device using `espressif/mdns` with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.\n\n## Affected\n\n- `esp-protocols < 1.11.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}