AIKIDO-2026-10863
aioesphomeapi is vulnerable to Resource Exhaustion
65
Medium Risk
This Affects:
aioesphomeapiTL;DR
The plaintext frame helper decodes varuint fields without bounding their width or the resulting frame length. A peer that can speak the plaintext API can stream unterminated varuints or declare very large lengths, causing unbounded buffering and repeated parsing work. Pre-fix clients can exhaust memory or CPU in long-running consumers such as Home Assistant. The fix caps varuint width and plaintext frame size and closes the connection on protocol violations.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and plaintext API mode is used without noise_psk.
Background info
aioesphomeapi is vulnerable to Resource Exhaustion in versions 19.0.1 - 45.0.0.
How to fix this
Upgrade the aioesphomeapi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant