espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the mdns component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in mdns_utils_read_fqdn(). An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an ESP-IDF device using espressif/mdns with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…tocols/security/advisories/GHSA-7fpr-vjw5-2c86 Diğer
• github.com/…ommit/95c882c7d7d661d28d4685bd052b024154a8402f Diğer
• github.com/…ressif/esp-protocols/releases/tag/mdns-v1.11.2 Diğer

Kayıt geçmişi

1. 5 Kas 2026 17:30Açıklama güncellendi
2. 5 Kas 2026 17:30Yama ya da düzeltilmiş sürüm çıktı
3. 5 Kas 2026 17:30CVSS puanı değişti: – → 6.5

İlgili açıklar

• 5,4 CVE-2026-76181Heap buffer overflow in dBASE index import
• 7,5 CVE-2026-82965Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing
• 7,7 CVE-2026-49407OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth
• 7,5 CVE-2026-110932Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache
• 7,5 CVE-2026-107123Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing
• 6,5 CVE-2026-112072vault-java-driver: stored deeply nested JSON kills every thread that reads it