NULL Pointer Dereference in Espressif IoT Framework WebSocket Component

CVE-2026-45541

What is CVE-2026-45541?

A NULL-pointer dereference vulnerability exists in the WebSocket subprotocol-negotiation of the esp_http_server component in certain versions of the Espressif Internet of Things Development Framework. During the WebSocket handshake, the Sec-WebSocket-Protocol header is parsed without proper NULL checks on the tokenization results. This oversight can lead to a server crash when a malformed header is utilized, which occurs prior to any authentication measures being implemented, potentially disrupting service availability. Updated versions contain patches that address this issue.

References