CVE-2026-45541 Overview
CVE-2026-45541 is a NULL pointer dereference vulnerability in the Espressif IoT Development Framework (ESP-IDF). The flaw resides in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenization result is dereferenced without a NULL check. A remote attacker can submit a malformed header value to crash the server before any application-level authentication runs. The issue affects ESP-IDF versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, and is fixed in 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
Critical Impact
Unauthenticated remote attackers can crash IoT devices running vulnerable ESP-IDF firmware by sending a single malformed WebSocket handshake request, resulting in denial of service.
Affected Products
- Espressif ESP-IDF version 5.2.6
- Espressif ESP-IDF versions 5.3.5, 5.4.4, and 5.5.4
- Espressif ESP-IDF version 6.0
Discovery Timeline
- 2026-06-10 - CVE-2026-45541 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-45541
Vulnerability Analysis
The vulnerability sits inside the WebSocket handshake handler of esp_http_server, the embedded HTTP server bundled with ESP-IDF. When a client opens a WebSocket connection, it can include a Sec-WebSocket-Protocol header listing subprotocols it supports. The server tokenizes that header value to negotiate a supported subprotocol with the application.
The tokenization routine can return a NULL result when the header value is empty or malformed. The handshake code dereferences this result without first validating the pointer, leading to a NULL pointer dereference [CWE-476]. On ESP32-class devices, dereferencing an invalid pointer causes a load/store prohibited exception and triggers a system reset.
Because the parsing occurs during the handshake — before any application-level authentication callback executes — no credentials are required to trigger the crash. The defect impacts availability without affecting confidentiality or integrity.
Root Cause
The root cause is a missing NULL check on the return value of the subprotocol tokenizer in components/esp_http_server/src/httpd_ws.c. Defensive validation of attacker-controlled header parsing output was absent in the WebSocket negotiation path.
Attack Vector
An attacker reaches the vulnerable code over the network by connecting to any HTTP endpoint on the device that has WebSocket support enabled. The attacker sends an HTTP/1.1 Upgrade: websocket request containing a malformed Sec-WebSocket-Protocol header. The server crashes during handshake processing, denying service to all clients until the device reboots and re-initializes the network stack.
// Patch from components/esp_http_server/src/httpd_ws.c
// Source: https://github.com/espressif/esp-idf/commit/0dc4ee7537f3b12350f5966cecacd59bba840ec6
/*
* SPDX-FileCopyrightText: 2020-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
// The fix adds a NULL check on the tokenization result before
// dereferencing it during Sec-WebSocket-Protocol negotiation.
Detection Methods for CVE-2026-45541
Indicators of Compromise
- Unexpected device reboots or Guru Meditation exceptions in ESP32 serial logs immediately following inbound HTTP/WebSocket connections.
- Inbound HTTP requests with Upgrade: websocket and empty, malformed, or unusual Sec-WebSocket-Protocol header values.
- Repeated TCP resets or connection drops on the device's HTTP server port from a single remote source.
Detection Strategies
- Inspect HTTP traffic at network gateways for malformed Sec-WebSocket-Protocol headers, including empty values, trailing commas, or non-printable characters.
- Correlate device watchdog resets and crash dumps with concurrent inbound WebSocket handshake attempts.
- Baseline ESP-IDF firmware versions across the IoT fleet and flag any device still running 5.2.6, 5.3.5, 5.4.4, 5.5.4, or 6.0.
Monitoring Recommendations
- Forward device serial console output and crash logs to a centralized log platform for correlation with network telemetry.
- Enable WAF or reverse-proxy logging in front of exposed IoT WebSocket endpoints to capture handshake header values.
- Alert on abnormal restart rates for ESP32-based devices, which often indicate exploitation of memory-safety defects.
How to Mitigate CVE-2026-45541
Immediate Actions Required
- Upgrade ESP-IDF to a patched release: 5.2.7, 5.3.6, 5.4.5, 5.5.5, or 6.0.1, and rebuild and re-flash all affected firmware images.
- Restrict network exposure of ESP-IDF HTTP/WebSocket endpoints to trusted management networks until devices can be patched.
- Inventory deployed firmware to identify devices built against the vulnerable ESP-IDF versions.
Patch Information
Espressif released fixes in ESP-IDF versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1. The fix adds a NULL check on the tokenization output in components/esp_http_server/src/httpd_ws.c during Sec-WebSocket-Protocol parsing. See the Espressif Security Advisory GHSA-3j8v-xgrq-5vg8 and the Espressif Commit Fix for technical details.
Workarounds
- Disable WebSocket support in esp_http_server configuration if the application does not require it.
- Place a reverse proxy or WAF in front of the device that strips or validates the Sec-WebSocket-Protocol header before forwarding handshake requests.
- Apply network ACLs to restrict inbound HTTP traffic to known client subnets.
# Update ESP-IDF to a patched release branch and rebuild firmware
cd $IDF_PATH
git fetch origin
git checkout v5.5.5 # or v5.2.7, v5.3.6, v5.4.5, v6.0.1
git submodule update --init --recursive
./install.sh
. ./export.sh
idf.py fullclean
idf.py build flash
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
