CVE-2026-45541: ESP-IDF WebSocket NULL Pointer DoS Vulnerability – High Severity

Technical summary

CVE-2026-45541 is a NULL-pointer dereference vulnerability in the esp_http_server component's WebSocket subprotocol-negotiation handler. During WebSocket handshake processing, the esp_http_server parses the client-supplied Sec-WebSocket-Protocol header and tokenizes the value. The code dereferences the tokenization result without verifying it is non-NULL, allowing a malformed header to trigger a NULL-pointer dereference and crash the server process. The vulnerability is classified as CWE-476 (NULL Pointer Dereference). Attack surface is pre-authentication—no prior compromise or valid credentials are needed.

Business impact

Organizations deploying ESP-IDF-based IoT devices with WebSocket functionality face potential service disruption. A remote attacker can repeatedly crash the device's HTTP server, disrupting legitimate WebSocket connections and any dependent monitoring, control, or data-streaming workflows. In industrial IoT, connected vehicles, or smart-home deployments, this can degrade safety and availability. Repeated crashes may also accelerate hardware wear or create attack openings for secondary exploitation if device restarts are infrequent or unmonitored.

Affected systems

Espressif ESP-IDF versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0 are vulnerable. Any device or application running these versions with WebSocket support enabled and exposed to untrusted network traffic is at risk. Patches are available: ESP-IDF 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1 contain the fix. Verify your deployed ESP-IDF version against release notes; many embedded IoT products do not automatically update.

Exploitability

Exploitability is straightforward: an attacker with network access to a vulnerable WebSocket endpoint can craft a single malformed Sec-WebSocket-Protocol header (e.g., a header with specific null-byte or truncated patterns) and send it as part of a WebSocket upgrade request. No special tools, authentication, or user interaction are required. The CVSS score of 7.5 (HIGH) reflects ease of remote exploitation and guaranteed availability impact, though confidentiality and integrity are unaffected.

Remediation

Apply the patched ESP-IDF version corresponding to your current release series: upgrade 5.2.x to 5.2.7 or later, 5.3.x to 5.3.6 or later, 5.4.x to 5.4.5 or later, 5.5.x to 5.5.5 or later, or 6.0 to 6.0.1 or later. If immediate patching is not feasible, disable WebSocket support in the HTTP server configuration or restrict network access to the server (firewall, VPN, or network segmentation) until patching is completed. Test patches in a staging environment before production rollout, especially for widely-deployed embedded devices.

Patch guidance

Espressif has released patched versions for all affected branches. Obtain updates from the official ESP-IDF GitHub repository or your device vendor's firmware distribution channel. Verify the patch by checking the component version in your build or by inspecting the esp_http_server source code for NULL checks around Sec-WebSocket-Protocol tokenization. If your device is supplied by a third-party vendor or OEM, contact them to confirm patch availability and rollout timeline; many IoT devices receive updates through vendor release schedules, not Espressif directly.

Detection guidance

Monitor ESP-IDF deployments for unexpected server restarts or unresponsive WebSocket services. Enable HTTP server logging and watch for malformed or truncated Sec-WebSocket-Protocol headers in access logs or crash dumps. Network intrusion detection systems can be tuned to flag WebSocket upgrade requests with suspiciously formatted or null-containing subprotocol headers. Review device firmware versions in your asset inventory against the vulnerable releases listed above. In a lab environment, attempt a WebSocket upgrade with a crafted Sec-WebSocket-Protocol header (e.g., a header with embedded nulls or truncation) to confirm if a device is vulnerable before patching.

Why prioritize this

This vulnerability merits urgent attention because it is unauthenticated, remotely exploitable, and results in guaranteed denial of service. It affects a widely-used embedded framework across IoT products. The pre-authentication attack surface means attackers do not need prior system access. Although CVSS confidentiality and integrity scores are zero, availability impact is severe and can be triggered repeatedly. Prioritize patching production and critical IoT deployments first, particularly those exposed to untrusted networks.

Risk score, explained

CVSS 7.5 (HIGH) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high availability impact (A:H). The score appropriately captures the ease and scope of exploitation despite the absence of confidentiality or integrity risk. For organizations with defense-in-depth controls (network segmentation, rate limiting, or graceful crash recovery), actual risk may be somewhat lower; conversely, organizations with critical availability requirements or minimal monitoring may perceive higher operational risk.

Frequently asked questions