CVE-2026-64860
espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the mdns component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in mdns_utils_read_fqdn(). An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an ESP-IDF device using espressif/mdns with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the mdns component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in mdns_utils_read_fqdn(). An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an ESP-IDF device using espressif/mdns with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
- Record
CVE-2026-64860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-674
- Updated
- 2026-11-05
EUVDEUVD-2026-117493
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the mdns component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in mdns_utils_read_fqdn(). An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an ESP-IDF device using espressif/mdns with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
- Record
EUVD-2026-117493- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
NVD
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the mdns component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in mdns_utils_read_fqdn(). An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an ESP-IDF device using espressif/mdns with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
- Record
CVE-2026-64860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-674
- Updated
- 2026-11-05
OSV
espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the mdns component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in mdns_utils_read_fqdn(). An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an ESP-IDF device using espressif/mdns with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
- Record
CVE-2026-64860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-674
- Updated
- 2026-11-07
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, references | CVE List, EUVD, NVD, OSV | |
| aliases, cwes, description, facts, products, references, severity, status, title | CVE List, EUVD | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-64860 is a medium vulnerability (CVSS 6.5) in Espressif Esp-protocols, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.
References
github.com/espressif/esp-protocols/security/advisories/GHSA-7fpr-vjw5-2c86
nvd.nist.gov/vuln/detail/CVE-2026-64860