ESPHome

Eine Sicherheitslücke in ESPHome erlaubt es Angreifern, Firmware-Updates über das Webinterface durchzuführen, ohne die konfigurierten Benutzerdaten eingeben zu müssen. Betroffen sind Versionen bis 2021.9.1 mit aktiviertem Web-Server und HTTP-Authentifizierung.

ESPHome Dashboard enthält eine Cross-Site-Scripting-Schwachstelle, bei der angemeldete Benutzer schädlichen JavaScript-Code in Konfigurationsdateien einschleusen können, um Session-Cookies zu stehlen und unbefugte Aktionen auszuführen.

ESPHome Dashboard-Komponente ist anfällig für Cross-Site Request Forgery-Angriffe, wodurch Angreifer über bösartige Webseiten Konfigurationsdateien im Namen angemeldeter Benutzer erstellen, bearbeiten oder löschen können.

Eine Sicherheitslücke in ESPHome ermöglicht es authentifizierten Angreifern, beliebige Dateien im Konfigurationsverzeichnis zu lesen und zu schreiben, was zur Ausführung von schädlichem Code führen kann.

ESPHome-Software auf ESP-IDF-Plattform hat einen Fehler in der Web-Server-Authentifizierung, der es Angreifern ermöglicht, ohne gültige Zugangsdaten auf geschützte Funktionen zuzugreifen, einschließlich Over-the-Air-Updates.

Ein Programmierfehler in ESPHome ermöglicht es Angreifern, Smart-Home-Geräte zum Absturz zu bringen, wenn die API-Verschlüsselung nicht aktiviert ist.

Release 2026-07-23

Release 2026-07-20

Release 2026-07-16

Release 2026-07-15

Release 2026-07-14

Release 2026-07-13

Release 2026-07-09

Release 2026-07-09

Release 2026-07-01

Release 2026-06-29

Release 2026-06-20

Release 2026-06-18

Release 2026-06-18

Release 2026-06-17

Release 2026-06-16

Release 2026-06-15

Release 2026-06-11

Bug fixes for RC5 remote decoding polarity issues, ESP-IDF version restoration during build processes, Windows path handling for RP2040 template loading, and duplicate BLE Device Information Service resolution with string UUIDs.

Bug fixes and improvements including crash loop resolution for voice assistant configuration, Windows symlink handling, RTL8710B flash image fixes, SX126x frequency calibration correction, enhanced crash debugging for ESP32, and build system improvements for toolchain changes.

Maintenance release with dependency updates, ESP-IDF toolchain improvements, bug fixes for Python 3.11 compatibility, Tuya status pin null guard restoration, SX126x sleep wake fixes, Bluetooth proxy connection recovery, and various platform-specific enhancements for ESP32, ESP8266, and LibreTiny.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.5.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.

Beta release with breaking changes to sensor device classes for sen5x, sgp4x, and sen6x components removing incorrect AQI classifications from VOC and NOx sensors. Also includes dependency updates, CI improvements, audio enhancements, and Zigbee configuration restrictions.

Beta release updating zeroconf and aioesphomeapi dependencies, removing version field from ESP-IDF component files, and improving ESP32 toolchain version checking to respect framework source overrides.

Beta release with ESP-IDF build improvements, TinyUSB configuration validation, toolchain warning fixes, and component updates. Breaking changes include stricter validation that rejects invalid TinyUSB and WiFi SSID configurations.

Beta release 2026.5.0b1 for ESPHome with various improvements and bug fixes. Specific changes not detailed in provided changelog link.

Maintenance release adding optional Device Builder toggle, fixing secrets handling with quoted keys, substitution references in dictionaries, WiFi connectivity in safe mode, and Nextion text sensor state updates.

Fixes automation codegen types, rejects unsupported MCP23xxx interrupt options, improves ESP32 printf handling and memory usage, clamps LVGL meter values, and enhances API service argument handling with logging improvements.

Bug fix release addressing LVGL tabview triggers, Windows timezone validation, deep sleep duration types, WiFi connection state tracking, rotary encoder field types, ESP32 WiFi bootloop issues with missing NVS partitions, Nextion upload timeouts, ESP32 touch watchdog feeding, and RGB565 alpha render

Bug fix release addressing LVGL display issues, memory optimization for RGB565 animations, core variable placement fixes, null pointer crash prevention in LD2412 sensor, and improvements to IO expander interrupt handling. Also adds ESP32 Secure Boot V1 ECDSA signing support.

Bug fix release addressing multiple component issues including display rendering problems, core stability fixes, watchdog timer handling, configuration parsing regressions, and compilation errors across various hardware platforms and components.

Beta release with various bug fixes including package include support, PlatformIO progress bar rendering, micro wake word stability improvements, web server OTA reset protection, and addressable light transition fixes. Also adds ESP32-P4 PDM microphone support and API speed optimizations.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.4.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.

Beta release 2026.4.0b1 for ESPHome with various improvements and bug fixes. Specific changes not detailed in provided changelog link.

Bug fixes for Nextion display queue timing, LVGL image handling when dimensions change, and ESP32 build process when SDK configuration options are modified.

Bug fix release addressing WiFi roaming issues, UART communication problems, sensor calibration errors, BLE server data handling, thermostat runtime logic, and memory leaks. Includes new ESP8266 scanf float option and improved timezone validation messaging.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.3.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.

Beta release containing multiple bug fixes including compilation errors, memory management issues, data races, and off-by-one errors in event pools across various components like API, speaker, ESP-NOW, USB, BLE, and MQTT modules.

Beta release containing multiple bug fixes across various components including frame parser length handling, IR checksum corrections, sensor component fixes, voice assistant null pointer dereference prevention, temperature reading corrections, and HTTP request data race resolution.

Beta release with library updates, ESP32-S3 compatibility improvements, dependency bumps, and various bug fixes including UART debug, temperature sensor division by zero, touch coordinate mapping, battery update throttling, lightning sensor energy mask, and version parsing enhancements.

Beta release 2026.3.0b1 for ESPHome with various improvements and bug fixes. Specific changes not detailed in the provided changelog link.

Release 2026-03-03

Bug fix release addressing multiple component issues including API connection failures, compilation errors, memory bugs, and sensor filter regressions. Fixes affect max7219digit, mipi_dsi, dsmr, haier, bme68x_bsec2, water_heater, pid, ld2420, rtttl, hmc5883l, and sensor components.

Bug fix release addressing compilation issues on newer ESP32 variants, BLE characteristic value overflow, socket allocation problems, E1.31 protocol support restoration, pulse counter glitch filter calculation error, and WiFi power management improvements to prevent brownouts.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.2.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.