ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses
Only affects ESP-IDF builds with CONFIG_LWIP_DNS_MAX_HOST_IP above 1 that resolve hostnames with multiple A or AAAA records via the DNS cache; fixed in 5.3.7, 5.4.5, 5.5.6, and 6.0.3.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 5.3.7, 5.4.5, 5.5.6, 6.0.3
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. CONFIG_LWIP_DNS_MAX_HOST_IP is set to a value greater than 1 A hostname resolves to multiple A or AAAA records and the result is served from the DNS cache The caller uses an API that supplies a single-element address buffer, such as the lwIP SNTP client
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity7.4/10CVSS 7.4
- No patch0/5No signal
What would change the score
- Would score about 69 if added to CISA KEV
- Would score about 64 if CISA's SSVC rates exploitation active
CVE-2026-113783 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.4 (high) and affects esp-idf; fixed in 5.3.7, 5.4.5, 5.5.6 and 1 more.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 19/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 5.3.7, 5.4.5, 5.5.6, 6.0.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Espressif's ESP-IDF framework for IoT devices has a stack-based memory corruption flaw in its lwIP DNS lookup handling, which occurs when a cached hostname has multiple A or AAAA records and the configuration allows more than one address per host. An attacker who can influence DNS responses can reach it remotely, without logging in, and can cause a device reboot or potentially redirect control flow.
Read the original description
ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.
What to do
Check whether your setup matches what the bug needs.
CONFIG_LWIP_DNS_MAX_HOST_IP is set to a value greater than 1 A hostname resolves to multiple A or AAAA records and the result is served from the DNS cache The caller uses an API that supplies a single-element address buffer, such as the lwIP SNTP clientUpgrade to a fixed version: 5.3.7, 5.4.5, 5.5.6, 6.0.3.
Workaround: Keep CONFIG_LWIP_DNS_MAX_HOST_IP=1 (the default), so a single cached address per hostname is used.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- espressif esp-idf
From 5.2.3 · through 5.2.8; From 5.3.2 · fixed in 5.3.7; From 5.4.0 · fixed in 5.4.5; From 5.5.0 · fixed in 5.5.6; From 6.0.0 · fixed in 6.0.3
Evidence 7
- Advisory
- Repository
- Repository
- Repository
- Repository
Show all 7 sourcesShow fewer sources
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-113783
Is CVE-2026-113783 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A hostname that resolves to several addresses can cause the DNS code to write more entries than the caller's buffer holds, corrupting stack memory. The device then aborts and reboots, which is a remote denial of service. Without stack protection, the corruption could potentially also change program logic or redirect control flow.Source: github.com
Which versions are affected by CVE-2026-113783?
esp-idf: from 5.2.3 through 5.2.8; from 5.3.2 before 5.3.7; from 5.4.0 before 5.4.5; from 5.5.0 before 5.5.6; from 6.0.0 before 6.0.3.Source: cve.now feed data
Am I affected, and how do I check?
ESP-IDF 5.2.3 through 5.2.8, 5.3.2 through 5.3.6, 5.4.0 through 5.4.4, 5.5.0 through 5.5.5, and 6.0.0 through 6.0.2 are in range. The bug needs CONFIG_LWIP_DNS_MAX_HOST_IP set above 1, a hostname with multiple A or AAAA records served from the DNS cache, and a caller using a single-element address buffer such as the lwIP SNTP client. Check the ESP-IDF version in your project and the value of CONFIG_LWIP_DNS_MAX_HOST_IP in menuconfig or sdkconfig.Source: github.com
How do I fix CVE-2026-113783?
Upgrade to ESP-IDF 5.3.7, 5.4.5, 5.5.6, or 6.0.3, matching your release line. If you cannot upgrade yet, keep CONFIG_LWIP_DNS_MAX_HOST_IP at 1, which is the default.Source: github.com