CVE-2026-45541

Name of the Vulnerable Software and Affected Versions ESF-IDF version 5.2.6 ESF-IDF version 5.3.5 ESF-IDF version 5.4.4 ESF-IDF version 5.5.4 ESF-IDF version 6.0

Description A NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp http server component. During the WebSocket handshake, the server parses the client-supplied Sec-WebSocket-Protocol request header, but the tokenisation result is dereferenced without a NULL check. Consequently, a malformed header value can cause the server to crash before any application-level authentication is executed.

Recommendations Update version 5.2.6 to 5.2.7 Update version 5.3.5 to 5.3.6 Update version 5.4.4 to 5.4.5 Update version 5.5.4 to 5.5.5 Update version 6.0 to 6.0.1