CVE-2026-45541 Details

A NULL-pointer dereference vulnerability has been identified in the WebSocket subprotocol negotiation of the esp_http_server component within the Espressif Internet of Things Development Framework (ESP-IDF). This issue is present in versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0. During the WebSocket handshake, the server parses the client-supplied Sec-WebSocket-Protocol header without checking for NULL values. A malformed header can cause the server to crash, bypassing any application-level authentication. The vulnerability arises when the application is built with WebSocket support enabled and registers WebSocket URI handlers that require subprotocol negotiation.

Users can upgrade to Espressif ESP-IDF versions 5.2.7, 5.3.6, 5.4.5, 5.5.5 or 6.0.1, where this vulnerability has been patched. If an immediate upgrade is not possible, WebSocket URI handlers can be registered without subprotocol negotiation, or mutual TLS authentication can be enabled on the HTTPS server to reject untrusted clients before the WebSocket parser is reached.