CVE-2026-64860
Dashboard / Vulnerabilities / CVE-2026-64860
Summary: espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression
Details: ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in `mdns_utils_read_fqdn()`. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an `ESP-IDF` device using `espressif/mdns` with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
References: https://github.com/espressif/esp-protocols/releases/tag/mdns-v1.11.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64860.json, https://github.com/espressif/esp-protocols/security/advisories/GHSA-7fpr-vjw5-2c86, https://nvd.nist.gov/vuln/detail/CVE-2026-64860, https://github.com/espressif/esp-protocols/commit/95c882c7d7d661d28d4685bd052b024154a8402f
Affected packages
Package
Name:
Purl:
