An unauthenticated remote denial of service vulnerability in ESPAsyncWebServer impacts the availability of ESP32, ESP8266, RP2040, and RP2350 devices by triggering a watchdog reset.

The vulnerability stems from an integer wraparound (CWE-190) in the src/WebRequest.cpp file, where the _boundaryPosition variable is stored as an 8-bit value. An unauthenticated attacker can send a request with a 256-byte multipart boundary, causing the value to wrap to zero and creating an infinite loop that exhausts CPU resources and triggers a system crash.

The flaw carries a CVSS score of 8.7, indicating a high severity risk due to the impact on system availability. Successful exploitation results in a complete denial of service, rendering affected IoT devices unresponsive and requiring a hardware reset. This poses a significant operational risk for environments relying on these microcontrollers for critical monitoring or control functions.

Immediate Action: Update the ESPAsyncWebServer library to version 3.11.1 or later, where the boundary parsing logic has been corrected.

Proactive Monitoring: Monitor device logs and system stability metrics for recurring watchdog resets or unusual spikes in CPU utilization that may indicate exploitation attempts.

Compensating Controls: Implement input validation at the network perimeter or via a Web Application Firewall to reject HTTP requests containing multipart boundaries exceeding standard expected sizes.

Public Exploit Available: No

Given the ease of triggering this denial of service, administrators of ESP-based infrastructure must prioritize updating the library to version 3.11.1. Testing the patch in a staging environment is advised to ensure compatibility with existing application logic before deploying to production devices.