EUVD-2026-35914Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
AnalysisAI
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to crash IoT devices by sending a malformed Sec-WebSocket-Protocol header. The flaw (CWE-476 NULL-pointer dereference) is triggered pre-authentication during subprotocol negotiation and affects ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0; no public exploit identified at time of analysis, though upstream commits disclose the exact vulnerable code path.
Technical ContextAI
ESP-IDF is Espressif's official IoT development framework for ESP32-family microcontrollers, widely embedded in commercial and hobbyist firmware. The vulnerable component is esp_http_server (components/esp_http_server/src/httpd_ws.c), which implements RFC 6455 WebSocket handshake handling. During subprotocol negotiation, the server tokenizes the client-supplied Sec-WebSocket-Protocol header using strtok_r and immediately dereferences the result inside a do-while loop without checking whether tokenisation returned NULL. A malformed or empty header value causes strtok_r to return NULL, which is then passed to strncmp, producing a NULL-pointer dereference (CWE-476) and crashing the HTTP server task. The upstream patch (commit 00a2f7f) restructures the loop into a while (s != NULL) form and additionally hardens the length comparison.
RemediationAI
Upgrade ESP-IDF to a vendor-released patched version on the matching release branch: 5.2.7, 5.3.6, 5.4.5, 5.5.5, or 6.0.1, then rebuild and reflash affected devices (see https://github.com/espressif/esp-idf/security/advisories/GHSA-3j8v-xgrq-5vg8 and fix commits 00a2f7fb, 0dc4ee75, 37508ab9, 9fc0ca13, dc46dc51, f88a47e4). For fleets where reflashing the entire population is not immediately feasible, compensating controls include disabling WebSocket support in the esp_http_server build configuration if not used (removes the vulnerable code path but breaks any WebSocket-dependent application features), restricting the device's HTTP/WebSocket listener to trusted VLANs or a management network via firewall/ACL (mitigates remote reachability but does not protect against insider or LAN-resident attackers), or fronting devices with a reverse proxy that validates the Sec-WebSocket-Protocol header format before forwarding (adds operational complexity and a new dependency).
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows th
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script t
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical s
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earli
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller ab
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page up
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the external
Denial of service in Espressif's ESP-IDF JPEG driver (versions 6.0.1, 5.5.4, 5.4.4, 5.3.5 and likely earlier) stems from
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today