CVE-2026-45541

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/espressif/esp-idf/commit/00a2f7fbbbd8fe6d04729022e1d5c9a49435bfe8	Patch
https://github.com/espressif/esp-idf/commit/0dc4ee7537f3b12350f5966cecacd59bba840ec6	Patch
https://github.com/espressif/esp-idf/commit/37508ab91124ef426a7396d30f79eba1162700c7	Patch
https://github.com/espressif/esp-idf/commit/9fc0ca13b3b85b98d32b98cd9dc8ff9d82642b7b	Patch
https://github.com/espressif/esp-idf/commit/dc46dc51359749e50617eb70d6f9ae298adc4fff	Patch
https://github.com/espressif/esp-idf/commit/f88a47e4f37fb11ae4b0908cd5c80059d83198c6	Patch
https://github.com/espressif/esp-idf/security/advisories/GHSA-3j8v-xgrq-5vg8	Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:espressif:esp-idf:5.2.6:::::::*
	cpe:2.3:a:espressif:esp-idf:5.3.5:::::::*
	cpe:2.3:a:espressif:esp-idf:5.4.4:::::::*
	cpe:2.3:a:espressif:esp-idf:5.5.4:::::::*
	cpe:2.3:a:espressif:esp-idf:6.0:::::::*

History

No history.

Information

Published : 2026-06-10 02:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-45541

Mitre link : CVE-2026-45541

CVE.ORG link : CVE-2026-45541

JSON object : View

Products Affected

espressif

esp-idf

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-45541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45541", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:40:06.288007Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "espressif", "product": "esp-idf", "versions": [{"status": "affected", "version": "= 6.0"}, {"status": "affected", "version": "= 5.5.4"}, {"status": "affected", "version": "= 5.4.4"}, {"status": "affected", "version": "= 5.3.5"}, {"status": "affected", "version": "= 5.2.6"}]}]}], "published": "2026-06-10T02:16:32.960", "references": [{"url": "https://github.com/espressif/esp-idf/commit/00a2f7fbbbd8fe6d04729022e1d5c9a49435bfe8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/0dc4ee7537f3b12350f5966cecacd59bba840ec6", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/37508ab91124ef426a7396d30f79eba1162700c7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/9fc0ca13b3b85b98d32b98cd9dc8ff9d82642b7b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/dc46dc51359749e50617eb70d6f9ae298adc4fff", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/commit/f88a47e4f37fb11ae4b0908cd5c80059d83198c6", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-3j8v-xgrq-5vg8", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1."}, {"lang": "es", "value": "ESF-IDF es el Framework de Desarrollo de Internet de las Cosas (IoT) de Espressif. En las versiones 5.2.6, 5.3.5, 5.4.4, 5.5.4 y 6.0, existe una desreferencia de puntero NULL en la ruta de negociaci\u00f3n del subprotocolo WebSocket del componente esp_http_server. Mientras se analiza el encabezado de solicitud Sec-WebSocket-Protocol suministrado por el cliente durante el handshake de WebSocket, el resultado de la tokenizaci\u00f3n se desreferencia sin una verificaci\u00f3n de NULL, por lo que un valor de encabezado malformado puede bloquear el servidor antes de que se ejecute cualquier autenticaci\u00f3n a nivel de aplicaci\u00f3n. Este problema ha sido parcheado en las versiones 5.2.7, 5.3.6, 5.4.5, 5.5.5 y 6.0.1."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37A040C2-E9D4-4678-9A10-74B5AEE4901D"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "662FF5D0-F1CA-46B6-B574-46B2B1AE0C27"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFFE1121-2E19-45C4-A597-35E029748C99"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D53A845-578D-4153-BE97-B24E4B75F3BE"}, {"criteria": "cpe:2.3:a:espressif:esp-idf:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9D5D616-4CBC-480A-A7CF-4B80D7D3FA17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}