Skip to content

Update dependency esphome to v2025 [SECURITY]#225

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-esphome-vulnerability
Open

Update dependency esphome to v2025 [SECURITY]#225
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-esphome-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Sep 2, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
esphome ==2024.10.3 → ==2025.8.1 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

GitHub Vulnerability Alerts

CVE-2025-57808

Summary

On the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value (e.g., correct username with partial password). This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password.

Details

The HTTP basic auth check in web_server_idf's AsyncWebServerRequest::authenticate only compares up to auth.value().size() - auth_prefix_len bytes of the base64-encoded user:pass string. This means a client-provided valuer like dXNlcjpz (user:s) will pass the check when the correct value is much longer, e.g., dXNlcjpzb21lcmVhbGx5bG9uZ3Bhc3M= (user:somereallylongpass).

Furthermore, the check will also pass when the supplied value is the empty string, which removes the need to know (or brute force) the username. A browser won't generally issue such a request, but it can easily be done by manually constructing the Authorizaztion request header (e.g., via curl).

PoC

Configure ESPHome as follows:

esp32:
  board: ...
  framework:
    type: esp-idf
web_server:
  auth:
    username: user
    password: somereallylongpass

In a browser, you can correctly log in by supplying username user and password somereallylongpass... but you can also incorrectly log in by supplying substrings of the password whose base64-encoded digest matches a prefix of the correct digest. (For example, I was able to log into an ESPHome device so configured by supplying password some... or even just s.)

You can also use a tool like curl to manually set an Authorization request header that always passes the check without any knowledge of the username:

$ curl -D- http://example.local/
HTTP/1.1 401 Unauthorized
...

$ curl -D- -H 'Authorization: Basic ' http://example.local/
HTTP/1.1 200 OK
...

Impact

This vulnerability effectively nullifies basic auth support for the ESP-IDF web_server, allowing auth bypass from another device on the local network with no knowledge of the correct username or password required.

Remediation

This vulnerability is fixed in 2025.8.1 and later.

For older versions, disabling the web_server component on ESP-IDF devices may be prudent, particularly if OTA updates through web_server are enabled.

Severity
  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Release Notes

esphome/esphome (esphome)

v2025.8.1

Compare Source

v2025.8.0

Compare Source

Full list of changes

New Features
New Components
New Platforms
Breaking Changes
All changes
Show

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) September 2, 2025 23:59
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 2 times, most recently from 1988ea0 to 675616a Compare September 28, 2025 05:02
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 2 times, most recently from 768e1ee to 61c7ee4 Compare October 29, 2025 16:11
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 4 times, most recently from 4449fb6 to 3544ef1 Compare November 24, 2025 09:06
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 5 times, most recently from cb8797d to ded02f0 Compare December 3, 2025 05:55
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 5 times, most recently from 400d897 to 42a00bd Compare December 11, 2025 00:08
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 5 times, most recently from cf297cd to 2f198dc Compare December 15, 2025 22:28
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 2 times, most recently from 38b50fd to 9361987 Compare January 9, 2026 20:47
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch from 9361987 to efc1b05 Compare January 16, 2026 20:38
@renovate renovate bot changed the title Update dependency esphome to v2025 [SECURITY] Update dependency esphome to v2025 [SECURITY] - autoclosed Jan 23, 2026
@renovate renovate bot closed this Jan 23, 2026
auto-merge was automatically disabled January 23, 2026 14:32

Pull request was closed

@renovate renovate bot deleted the renovate/pypi-esphome-vulnerability branch January 23, 2026 14:32
@renovate renovate bot changed the title Update dependency esphome to v2025 [SECURITY] - autoclosed Update dependency esphome to v2025 [SECURITY] Jan 23, 2026
@renovate renovate bot reopened this Jan 23, 2026
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 2 times, most recently from efc1b05 to 1903b9d Compare January 23, 2026 17:52
@renovate renovate bot enabled auto-merge (squash) January 23, 2026 23:12
@renovate renovate bot changed the title Update dependency esphome to v2025 [SECURITY] Update dependency esphome to v2025 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate bot closed this Mar 27, 2026
auto-merge was automatically disabled March 27, 2026 02:14

Pull request was closed

@renovate renovate bot changed the title Update dependency esphome to v2025 [SECURITY] - autoclosed Update dependency esphome to v2025 [SECURITY] Mar 30, 2026
@renovate renovate bot reopened this Mar 30, 2026
@renovate renovate bot force-pushed the renovate/pypi-esphome-vulnerability branch 2 times, most recently from 1903b9d to 9eae489 Compare March 30, 2026 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@chrisns chrisns

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chrisns