Vulnerability in Espressif Arduino-esp32
CVE-2025-53007
arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` function takes arbitrary input for the HTTP header name and value, concatenates t…
EPSS: 0.004 (32.0th percentile) — read the EPSS interpretation.
Affected products
- Espressif Arduino-esp32 — versions < 3.2.1, >= 3.3.0-alpha1, < 3.3.0-RC1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)