CVE-2026-113783

Name of the Vulnerable Software and Affected Versions ESP-IDF versions 5.2.3 through 5.3.6 ESP-IDF versions 5.4.0 through 5.4.4 ESP-IDF versions 5.5.0 through 5.5.5 ESP-IDF versions 6.0.0 through 6.0.2

Description The lwIP DNS resolver contains a flaw in the cached-lookup path within the dns lookup() function in dns.c. The function copies cached addresses into a single ip addr t output buffer without performing bounds checks or using a length parameter. When the CONFIG LWIP DNS MAX HOST IP variable is set to a value greater than 1 and a cached hostname contains multiple A or AAAA records, calls to dns gethostbyname() or dns gethostbyname addrtype() can result in a stack-based buffer overflow. A network-positioned attacker capable of influencing DNS responses could trigger a system reboot via stack-canary corruption or overwrite stack variables to potentially redirect control flow.

Recommendations Update to version 5.3.7 Update to version 5.4.5 Update to version 5.5.6 Update to version 6.0.3 At the moment, there is no information about a newer version that contains a fix for this vulnerability for the 5.2 line.