CVE-2026-45541 ESF-IDF: Remote Null Pointer Dereference in WebSocket Server

What is CVE-2026-45541?

CVE-2026-45541 is a high-severity vulnerability in espressif esp-idf, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

Weakness: CWE-476

Which versions are affected by CVE-2026-45541?

It affects 1 product.

Products include Espressif Esp-Idf.

How do I fix CVE-2026-45541?

No fix has been published for CVE-2026-45541 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-45541 being exploited?

There is no known exploitation of CVE-2026-45541 in the wild and no public exploit code.

Other vulnerabilities in espressif esp-idf

• CVE-2026-45328 ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers Critical 9.3
• CVE-2024-53406 Auth bypass in n/a High 8.8
• CVE-2021-28139 Memory corruption in n/a High 8.8
• CVE-2024-33453 Information disclosure in n/a High 8.1
• CVE-2019-12587 Weak cryptography in n/a High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3j8v-xgrq-5vg8.