{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23833", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T15:46:40.841Z", "datePublished": "2026-01-19T17:58:50.499Z", "dateUpdated": "2026-01-20T21:39:18.848Z"}, "containers": {"cna": {"title": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"}, {"name": "https://github.com/esphome/esphome/pull/13306", "tags": ["x_refsource_MISC"], "url": "https://github.com/esphome/esphome/pull/13306"}, {"name": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6", "tags": ["x_refsource_MISC"], "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"}, {"name": "https://esphome.io/guides/security_best_practices", "tags": ["x_refsource_MISC"], "url": "https://esphome.io/guides/security_best_practices"}], "affected": [{"vendor": "esphome", "product": "esphome", "versions": [{"version": ">= 2025.9.0, < 2025.12.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:58:50.499Z"}, "descriptions": [{"lang": "en", "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."}], "source": {"advisory": "GHSA-4h3h-63v6-88qx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T21:39:09.658572Z", "id": "CVE-2026-23833", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:39:18.848Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23833", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T21:39:09.658572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:39:15.831Z"}}], "cna": {"title": "ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component", "source": {"advisory": "GHSA-4h3h-63v6-88qx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "esphome", "product": "esphome", "versions": [{"status": "affected", "version": ">= 2025.9.0, < 2025.12.7"}]}], "references": [{"url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx", "name": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/esphome/esphome/pull/13306", "name": "https://github.com/esphome/esphome/pull/13306", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6", "name": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6", "tags": ["x_refsource_MISC"]}, {"url": "https://esphome.io/guides/security_best_practices", "name": "https://esphome.io/guides/security_best_practices", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T17:58:50.499Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23833", "state": "PUBLISHED", "dateUpdated": "2026-01-20T21:39:18.848Z", "dateReserved": "2026-01-16T15:46:40.841Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T17:58:50.499Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check `ptr + field_length > end` in `components/api/proto.cpp` can overflow when a malicious client sends a large `field_length` value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Users should upgrade to ESPHome 2025.12.7 or later to receive a patch, enable API encryption with a unique key per device, and follow the Security Best Practices."}], "id": "CVE-2026-23833", "lastModified": "2026-01-19T18:16:06.007", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-01-19T18:16:06.007", "references": [{"source": "security-advisories@github.com", "url": "https://esphome.io/guides/security_best_practices"}, {"source": "security-advisories@github.com", "url": "https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6"}, {"source": "security-advisories@github.com", "url": "https://github.com/esphome/esphome/pull/13306"}, {"source": "security-advisories@github.com", "url": "https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "ESPHome: ESPHome: Denial of Service via integer overflow in API protobuf decoder", "id": "2430945", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430945"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in ESPHome. An integer overflow vulnerability exists in the API component's protobuf decoder. A remote attacker can exploit this by sending a specially crafted, large field_length value, which bypasses a bounds check. This can lead to a denial-of-service (DoS) condition, causing the affected device to crash. This attack can be performed without authentication if API encryption is not utilized."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, enable API encryption with a unique key for each ESPHome device. This prevents unauthenticated denial-of-service attacks by requiring knowledge of the encryption key for exploitation. Refer to ESPHome's Security Best Practices for detailed configuration instructions."}, "name": "CVE-2026-23833", "public_date": "2026-01-19T17:58:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23833\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23833\nhttps://esphome.io/guides/security_best_practices\nhttps://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6\nhttps://github.com/esphome/esphome/pull/13306\nhttps://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx"], "statement": "This vulnerability is rated Low for Red Hat. The flaw in ESPHome's API component, affecting `python-aioesphomeapi` in Fedora 42, can lead to a denial of service. Exploitation requires the API encryption to be disabled; if encryption is enabled, knowledge of the encryption key is necessary.", "threat_severity": "Low"}

{"created": "2026-01-20T08:40:18.073984+00:00", "updated": "2026-01-20T08:40:18.074012+00:00", "vendors": ["esphome", "esphome$PRODUCT$esphome"]}