CVE-2026-45541: ESF-IDF: Remote Null Pointer Dereference in WebSocket Server
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esphttpserver component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 5.2.7 - Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 5.3.6 - Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 5.4.5 - Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 5.5.5 - Upgrade
Upgrade
ESF-IDFto a version that resolves this vulnerability.Fixed in 6.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45541?
CVE-2026-45541 has a high severity score of 7.5.
How do I fix CVE-2026-45541?
To fix CVE-2026-45541, upgrade to a patched version of the Espressif ESP-IDF Development Framework beyond version 6.0.
What component is affected by CVE-2026-45541?
CVE-2026-45541 affects the esp_http_server component within the Espressif ESP-IDF.
What type of vulnerability is CVE-2026-45541?
CVE-2026-45541 is classified as a Null Pointer Dereference vulnerability.
How can CVE-2026-45541 impact my application?
CVE-2026-45541 can lead to application crashes due to a NULL-pointer dereference during WebSocket protocol negotiation.