CVE-2026-45541

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-45541
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/espressif/esp-idf/commit/00a2f7fbbbd8fe6d04729022e1d5c9a49435bfe8 Patch
https://github.com/espressif/esp-idf/commit/0dc4ee7537f3b12350f5966cecacd59bba840ec6 Patch
https://github.com/espressif/esp-idf/commit/37508ab91124ef426a7396d30f79eba1162700c7 Patch
https://github.com/espressif/esp-idf/commit/9fc0ca13b3b85b98d32b98cd9dc8ff9d82642b7b Patch
https://github.com/espressif/esp-idf/commit/dc46dc51359749e50617eb70d6f9ae298adc4fff Patch
https://github.com/espressif/esp-idf/commit/f88a47e4f37fb11ae4b0908cd5c80059d83198c6 Patch
https://github.com/espressif/esp-idf/security/advisories/GHSA-3j8v-xgrq-5vg8 Mitigation Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:6.0:*:*:*:*:*:*:*
History

23 Jul 2026, 09:10

Type Values Removed Values Added
Summary
  • (es) ESF-IDF es el Framework de Desarrollo de Internet de las Cosas (IoT) de Espressif. En las versiones 5.2.6, 5.3.5, 5.4.4, 5.5.4 y 6.0, existe una desreferencia de puntero NULL en la ruta de negociación del subprotocolo WebSocket del componente esp_http_server. Mientras se analiza el encabezado de solicitud Sec-WebSocket-Protocol suministrado por el cliente durante el handshake de WebSocket, el resultado de la tokenización se desreferencia sin una verificación de NULL, por lo que un valor de encabezado malformado puede bloquear el servidor antes de que se ejecute cualquier autenticación a nivel de aplicación. Este problema ha sido parcheado en las versiones 5.2.7, 5.3.6, 5.4.5, 5.5.5 y 6.0.1.

11 Jun 2026, 18:05

Type Values Removed Values Added
CPE cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*
cpe:2.3:a:espressif:esp-idf:6.0:*:*:*:*:*:*:*
First Time Espressif esp-idf
Espressif
References () https://github.com/espressif/esp-idf/commit/00a2f7fbbbd8fe6d04729022e1d5c9a49435bfe8 - () https://github.com/espressif/esp-idf/commit/00a2f7fbbbd8fe6d04729022e1d5c9a49435bfe8 - Patch
References () https://github.com/espressif/esp-idf/commit/0dc4ee7537f3b12350f5966cecacd59bba840ec6 - () https://github.com/espressif/esp-idf/commit/0dc4ee7537f3b12350f5966cecacd59bba840ec6 - Patch
References () https://github.com/espressif/esp-idf/commit/37508ab91124ef426a7396d30f79eba1162700c7 - () https://github.com/espressif/esp-idf/commit/37508ab91124ef426a7396d30f79eba1162700c7 - Patch
References () https://github.com/espressif/esp-idf/commit/9fc0ca13b3b85b98d32b98cd9dc8ff9d82642b7b - () https://github.com/espressif/esp-idf/commit/9fc0ca13b3b85b98d32b98cd9dc8ff9d82642b7b - Patch
References () https://github.com/espressif/esp-idf/commit/dc46dc51359749e50617eb70d6f9ae298adc4fff - () https://github.com/espressif/esp-idf/commit/dc46dc51359749e50617eb70d6f9ae298adc4fff - Patch
References () https://github.com/espressif/esp-idf/commit/f88a47e4f37fb11ae4b0908cd5c80059d83198c6 - () https://github.com/espressif/esp-idf/commit/f88a47e4f37fb11ae4b0908cd5c80059d83198c6 - Patch
References () https://github.com/espressif/esp-idf/security/advisories/GHSA-3j8v-xgrq-5vg8 - () https://github.com/espressif/esp-idf/security/advisories/GHSA-3j8v-xgrq-5vg8 - Mitigation, Patch, Vendor Advisory

10 Jun 2026, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-10 02:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-45541

Mitre link : CVE-2026-45541

CVE.ORG link : CVE-2026-45541

JSON object : View

Products Affected

espressif

  • esp-idf
CWE
CWE-476

NULL Pointer Dereference