CVE-2026-42855

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42855", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-30T16:44:48.379Z", "datePublished": "2026-05-12T21:56:08.490Z", "dateUpdated": "2026-05-13T15:36:54.428Z"}, "containers": {"cna": {"title": "arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq"}], "affected": [{"vendor": "espressif", "product": "arduino-esp32", "versions": [{"version": "< 3.3.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:56:08.490Z"}, "descriptions": [{"lang": "en", "value": "arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8."}], "source": {"advisory": "GHSA-28hv-fwm3-rpcq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T15:32:50.254940Z", "id": "CVE-2026-42855", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:36:54.428Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42855", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:32:50.254940Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:32:53.132Z"}}], "cna": {"title": "arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack", "source": {"advisory": "GHSA-28hv-fwm3-rpcq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "espressif", "product": "arduino-esp32", "versions": [{"status": "affected", "version": "< 3.3.8"}]}], "references": [{"url": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq", "name": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:56:08.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42855", "state": "PUBLISHED", "dateUpdated": "2026-05-13T15:36:54.428Z", "dateReserved": "2026-04-30T16:44:48.379Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T21:56:08.490Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "arduino-esp32", "vendor": "espressif", "versions": [{"status": "affected", "version": "< 3.3.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:espressif:arduino-esp32:*:-:*:*:*:*:*:*", "matchCriteriaId": "308785AC-A885-47B5-9131-64AE662B6525", "versionEndExcluding": "3.3.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8."}, {"lang": "es", "value": "arduino-esp32 es un n\u00facleo de Arduino para los microcontroladores ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 y ESP32-H2. Antes de 3.3.8, la implementaci\u00f3n de autenticaci\u00f3n Digest de WebServer en arduino-esp32 calcula el hash de autenticaci\u00f3n utilizando el campo URI del encabezado de autorizaci\u00f3n del cliente, sin verificar que coincida con la URI real solicitada. Esto permite a un atacante que posee cualquier respuesta digest v\u00e1lida (calculada para URI-A) autenticar solicitudes a una URI protegida completamente diferente (URI-B), eludiendo el control de acceso por recurso. Esta vulnerabilidad se corrigi\u00f3 en 3.3.8."}], "id": "CVE-2026-42855", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42855", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T15:32:50.254940Z", "version": "2.0.3"}}]}, "published": "2026-05-12T22:16:35.067", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "arduino-esp32", "source": "cna", "vendor": "espressif"}, "product": "arduino-esp32", "vendor": "espressif"}], "created": "2026-05-12T23:45:25.190943+00:00", "updated": "2026-05-15T18:15:05.632293+00:00", "vendors": ["espressif", "espressif$PRODUCT$arduino-esp32"]}