CVE-2026-45541
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In the ESP-IDF Espressif IoT Development Framework, a NULL-pointer dereference exists in the esp_http_server component during WebSocket subprotocol negotiation. The missing NULL check on the tokenization result of the Sec-WebSocket-Protocol header can crash the server before authentication.
Risk Assessment
An attacker can remotely crash the HTTP server, causing IoT service disruption and potential DoS attacks.
Recommendation
Update ESP-IDF to versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, or 6.0.1, which contain the fix.
Other vulnerabilities in ESP-IDF
See all- CVE-2026-45328Critical
Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0 have a vulnerability in the esp_tee component that exposes secure-service wrappers. An attacker can exploit these wrappers to gain unauthorized access to TEE-protected peripherals.
- CVE-2026-55687High
A vulnerability in the Espressif IoT Development Framework (ESP-IDF) allows an out-of-bounds write on the stack when parsing the DQT marker in JPEG files. An attacker can supply a crafted JPEG image, leading to a denial of service.
- CVE-2026-46532Medium
ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 contain an out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd). Patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.
- CVE-2026-45542High
Heap buffer overflow in the protocomm component of the ESP-IDF IoT framework. Occurs during Security Scheme 2 (SRP6a) session setup, where a client-supplied username length is copied into a smaller buffer, corrupting the heap.
- CVE-2026-45329High
In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.
- CVE-2026-45160Medium
ESP-IDF (Espressif IoT Development Framework) has an out-of-bounds read vulnerability in the DHCP server option parser in the lwIP component. A crafted DHCP request can cause reads past the buffer into adjacent heap memory.
Original NVD description (English source)
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.