CVE-2026-23833: ESPHome Denial-of-Service Vulnerability via Out-of-Bounds Check Bypass
Summary
CVE-2026-23833: ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component. Affects esphome versions >= 2025.9.0, < 2025.12.7. Fixed in 2025.12.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ESPHome is an open-source project that allows users to create custom firmware for various IoT devices, including ESP32, ESP8266, RP2040, and LibreTiny platforms. It provides a user-friendly interface for configuring and managing these devices, enabling seamless integration with home automation systems. However, a recent vulnerability has been identified in its API component, which could lead to denial-of-service attacks if not addressed promptly.
Vulnerability Detail
An integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The bounds check 'ptr + field_length > end' in components/api/proto.cpp can overflow when a malicious client sends a large field_length value. This vulnerability affects all ESPHome device platforms and can cause the device to read invalid memory, leading to crashes. When using the plaintext API protocol, this attack can be executed without authentication, making it particularly concerning for users who do not implement security measures.
How To Fix
Latest published version: 2026.10.0 as of 22 Oct 2026
pip install --upgrade "esphome==2026.10.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2025.12.7
This is the first release that contains the fix.
pip install --upgrade "esphome==2025.12.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to enable API encryption with a unique key per device. This can be done by modifying the configuration file to include the following lines: 'api: encryption: key: YOUR_UNIQUE_KEY'. Replace 'YOUR_UNIQUE_KEY' with a strong, unique key for each device.
Conclusion
In summary, CVE-2026-23833 is a significant vulnerability in ESPHome that can lead to denial-of-service attacks if not addressed. Users are encouraged to upgrade to the patched version and implement API encryption to safeguard their devices. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for esphome →
FAQ
CVE-2026-23833 is a vulnerability in ESPHome that allows denial-of-service attacks via an out-of-bounds check bypass in the API component.
If your ESPHome devices are running affected versions and API encryption is not enabled, they can be crashed by sending specially crafted requests.
ESPHome versions 2025.9.0 through 2025.12.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for esphome.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
