EUVD-2026-35914Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable ESP32 device with HTTP server
-
DeliverySend WebSocket upgrade with malformed Sec-WebSocket-Protocol header
-
ExploitTrigger NULL-pointer dereference in httpd_ws_get_response_subprotocol
-
ExecutionCrash esp_http_server task
-
ImpactDevice loses HTTP/management availability until reboot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target device must run ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, or 6.0 with the esp_http_server component compiled in and WebSocket support enabled, and must expose its HTTP server on a network reachable by the attacker. The attacker must be able to send a TCP HTTP upgrade request carrying a crafted Sec-WebSocket-Protocol header whose strtok_r tokenisation returns NULL (e.g., empty or delimiter-only value). No authentication, user interaction, or non-default platform-specific configuration is required beyond having the WebSocket subprotocol-negotiation code path reachable; the crash occurs before application-level authentication. Limiting factors: devices that do not enable WebSocket support in esp_http_server, or whose HTTP listener is bound only to loopback/segregated networks, are not remotely exploitable. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects an unauthenticated, low-complexity, network-reachable availability-only impact - exactly a remote DoS. There is no confidentiality or integrity impact, and the vulnerability cannot be escalated to code execution given the NULL-deref nature. No EPSS score, KEV listing, or POC was provided, so this is best classified as no public exploit identified at time of analysis; however, the public patch commits clearly identify the trigger, lowering the bar for a researcher to craft a one-packet crash. Real-world risk is highest for fleets of ESP32-based devices exposing esp_http_server WebSocket endpoints to untrusted networks (e.g., LAN-exposed smart-home or industrial gateways), where a single crafted request can knock devices offline; for devices only reachable from trusted networks the risk is meaningfully lower. SSVC inputs not supplied, but exploitation should be considered automatable and the technical impact partial (availability only). |
| Exploit ScenarioDerived | An attacker on the same network as an ESP32 device running an esp_http_server WebSocket endpoint sends a single HTTP GET upgrade request with a malformed Sec-WebSocket-Protocol header (for example, a header whose tokenisation yields no first token). The server dereferences a NULL pointer during subprotocol matching and crashes the HTTP task, taking the device's management or telemetry interface offline until reboot or watchdog reset. The crash occurs before any application-level authentication, so no credentials or prior access are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to crash IoT devices by sending a malformed Sec-WebSocket-Protocol header. The flaw (CWE-476 NULL-pointer dereference) is triggered pre-authentication during subprotocol negotiation and affects ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0; no public exploit identified at time of analysis, though upstream commits disclose the exact vulnerable code path.
RemediationAI
Upgrade ESP-IDF to a vendor-released patched version on the matching release branch: 5.2.7, 5.3.6, 5.4.5, 5.5.5, or 6.0.1, then rebuild and reflash affected devices (see https://github.com/espressif/esp-idf/security/advisories/GHSA-3j8v-xgrq-5vg8 and fix commits 00a2f7fb, 0dc4ee75, 37508ab9, 9fc0ca13, dc46dc51, f88a47e4). For fleets where reflashing the entire population is not immediately feasible, compensating controls include disabling WebSocket support in the esp_http_server build configuration if not used (removes the vulnerable code path but breaks any WebSocket-dependent application features), restricting the device's HTTP/WebSocket listener to trusted VLANs or a management network via firewall/ACL (mitigates remote reachability but does not protect against insider or LAN-resident attackers), or fronting devices with a reverse proxy that validates the Sec-WebSocket-Protocol header format before forwarding (adds operational complexity and a new dependency).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ESP-IDF is Espressif's official IoT development framework for ESP32-family microcontrollers, widely embedded in commercial and hobbyist firmware. The vulnerable component is esp_http_server (components/esp_http_server/src/httpd_ws.c), which implements RFC 6455 WebSocket handshake handling. During subprotocol negotiation, the server tokenizes the client-supplied Sec-WebSocket-Protocol header using strtok_r and immediately dereferences the result inside a do-while loop without checking whether tokenisation returned NULL. A malformed or empty header value causes strtok_r to return NULL, which is then passed to strncmp, producing a NULL-pointer dereference (CWE-476) and crashing the HTTP server task. The upstream patch (commit 00a2f7f) restructures the loop into a while (s != NULL) form and additionally hardens the length comparison.
Know when Esp Idf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check, so a malformed header value can crash the server before any application-level authentication runs. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
Executive ViewAI
Espressif ESP-IDF framework contains a remote denial-of-service vulnerability (CVE-2026-45541, CVSS 7.5) affecting IoT device deployments across versions 5.2.6 through 6.0; no public exploit identified at time of analysis. The flaw can be exploited by unauthenticated network attackers without special privileges, creating potential service disruption for any organization operating ESP-IDF-based IoT infrastructure. The absence of a vendor patch requires immediate interim mitigations to protect operational continuity.
Network-level rate limiting on WebSocket handshake requests to prevent rapid connection attempts; input filtering at perimeter for malformed Sec-WebSocket-Protocol headers; network segmentation isolating IoT devices from untrusted network segments; application-level monitoring for abnormal connection patterns; disable WebSocket functionality if not mission-critical to device operation; restrict WebSocket client sources via network access control lists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in ESP-IDF Memory Safety and Input Validation Flaws
View all 6Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows th
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script t
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical s
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page up
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the external
Denial of service in Espressif's ESP-IDF JPEG driver (versions 6.0.1, 5.5.4, 5.4.4, 5.3.5 and likely earlier) stems from
An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel pack
Exploit-DB