{"id":"CVE-2025-55297","summary":"ESF-IDF BluFi Example Memory Overflow Vulnerability","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas: Wi-Fi credential handling and Diffie–Hellman key exchange. This vulnerability is fixed in 5.4.1, 5.3.3, 5.1.6, and 5.0.9.","aliases":["GHSA-9w88-r2vm-qfc4"],"modified":"2026-08-12T15:16:44.725601Z","published":"2025-08-21T15:05:06.805Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-120","CWE-131"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55297.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55297.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-9w88-r2vm-qfc4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55297"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"0"},{"fixed":"dd9987d4697cb9bb5c3b5d30ef50b3750280badd"},{"introduced":"012fafb82781f2720f2c636ed3b0ebd0db02cd9d"},{"fixed":"7452b1cb1d22cd1b439a6a922548efacea98ee72"},{"introduced":"f8d2c0894cf3c12dc231dafebf75d3f1002b312c"},{"fixed":"6db3dc25df7325c1c81b7cd7d4e42babff7a818e"},{"introduced":"0436d4981593e349f82c49007c79f69be8c3cec7"},{"fixed":"4c2820d377d1375e787bcef612f0c32c1427d183"},{"fixed":"12b7a9e6d78012ab9184b7ccdb5524364bf7e345"},{"fixed":"3fc6c93936077cb1659e1f0e0268e62cf6423e9d"},{"fixed":"5f93ec3b11b6115475c34de57093b3672d594e8f"},{"fixed":"9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa"},{"fixed":"abc18e93eb3500dbec74c3e589671ef82c8b3919"},{"fixed":"b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84"},{"fixed":"bf50c0c197af30990026c8f8286298d2aa5a3c99"},{"fixed":"cb6929a2e6f2ff130b742332dc15eb23006c7cc9"},{"fixed":"cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501"},{"fixed":"e65cf7ea2a2be52219ec9d4efc44aed5e490e91c"},{"fixed":"f40aa9c587a8e570dfde2e6330382dcd170d5a5d"},{"fixed":"f77da0d5b5382635c99e6708551b73802ad1213d"}],"database_specific":{"cpe":"cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.0.9"},{"introduced":"5.1"},{"fixed":"5.1.6"},{"introduced":"5.2"},{"fixed":"5.3.3"},{"introduced":"5.4"},{"fixed":"5.4.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v5.1","v5.0.8","v5.4-beta2","v5.3","v5.3-rc1","v5.3-beta2","v5.3-beta1","v5.2-rc1","v5.2","v5.2-beta2","v5.2-beta1","v5.0","v5.1-rc2","v5.1-rc1","v5.1-beta1","v5.2-dev","v5.0-rc1","v5.0-beta1","v5.0-dev","v4.3-beta1","v4.3-dev","v4.2-dev","v4.1-dev","v4.0-dev","v3.3-beta2","v3.3-beta1","v3.2-beta1","v3.3-dev","v3.1-beta1","v3.2-dev","v3.1-dev","v2.1-rc1","v3.0-dev","v2.0-rc1","v1.0","v0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55297.json","vanir_signatures_modified":"2026-08-12T15:16:44Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_encrypt"},"deprecated":false,"digest":{"function_hash":"148374765658899350929694388313723438628","length":340},"id":"CVE-2025-55297-0b2e1dfa","signature_type":"Function"},{"target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_security_init"},"deprecated":false,"digest":{"function_hash":"14725441456098670115516619737556179302","length":302},"id":"CVE-2025-55297-0f98f0e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99"},{"source":"https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"},"deprecated":false,"digest":{"line_hashes":["156718069195225552601309518493754853400","4651273288141566203432787391121677576","5450208424883404953253788947636113072","212250662498059847845573964628673736154","140443780821930965946982575988969922783","125483958846573307628727124779218251622","192589945895917643578248128019074152363","23025681073281916378065892596205255988","265090150793358509237187042393682248086","98850339263440219764764085097559643670","28706277393444943867421732117850720742","319014018412117820981892491866096122588","11535038317845881545672410981899497224","132299173107655464416739961996593942283","62475831688793100973146978827325373036","239959748408126982566592479045931394852","312409216813545517587353631923860324521","177367434480545604463513578326446377267"],"threshold":0.9},"id":"CVE-2025-55297-10cddfa9","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"232150552316914472929541799588413471679","length":5516},"id":"CVE-2025-55297-157c4f43","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false},{"id":"CVE-2025-55297-158c3762","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"76431154367445552284709138797959255010","length":6458}},{"target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_encrypt"},"deprecated":false,"digest":{"length":340,"function_hash":"148374765658899350929694388313723438628"},"id":"CVE-2025-55297-16bd83eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_decrypt"},"deprecated":false,"digest":{"function_hash":"245315487047378546250681581351188821101","length":340},"id":"CVE-2025-55297-213164e9"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"},"deprecated":false,"digest":{"line_hashes":["156718069195225552601309518493754853400","4651273288141566203432787391121677576","5450208424883404953253788947636113072","212250662498059847845573964628673736154","140443780821930965946982575988969922783","125483958846573307628727124779218251622","192589945895917643578248128019074152363","23025681073281916378065892596205255988","265090150793358509237187042393682248086","98850339263440219764764085097559643670","28706277393444943867421732117850720742","319014018412117820981892491866096122588","11535038317845881545672410981899497224","132299173107655464416739961996593942283","62475831688793100973146978827325373036","239959748408126982566592479045931394852","312409216813545517587353631923860324521","177367434480545604463513578326446377267"],"threshold":0.9},"id":"CVE-2025-55297-214ac84b","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_security_init"},"deprecated":false,"digest":{"function_hash":"14725441456098670115516619737556179302","length":302},"id":"CVE-2025-55297-22370f32"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d","target":{"function":"blufi_security_init","file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"function_hash":"14725441456098670115516619737556179302","length":302},"id":"CVE-2025-55297-2387ec6c","signature_type":"Function"},{"target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_encrypt"},"deprecated":false,"digest":{"function_hash":"148374765658899350929694388313723438628","length":340},"id":"CVE-2025-55297-254a5491","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d"},{"deprecated":false,"digest":{"line_hashes":["331085582535187419312669822313643256965","53280089156829210102589430749821973233","66895631876915309861787544348224261266","255328099612524442794757175403486629986","107411516224373670792224413698744463659","290672867258660951153969341466147841092","315298965330385692252646691338231720439","237769193488741412837818091658366218210","64564447095901283280977959803705123007","282893786190011153348779993857997488423","1773399234369843911083680917736783217","167832072059108668665289574497882621108","158136300225517230591717742470204375658","284851961722471322760438115313934715542","160283916475820659823012896819183694794","116477153524842790203027684448068635436","36485641714094567203105192577993181147","139552526746762588164594227841489114670","265355326638851894862345915353688477286","22765400381394925324899167413125436737","336136338496401826162053598069532485784","296431503006548955940805791929661303055","245453214213298609701237717330392100254","299081461237806767867009715687590316788","161855082983536272759085928800850997066","245453214213298609701237717330392100254","299081461237806767867009715687590316788","278416689349687702853168482721342856062","264117386686085264674729736361823270112","100211741724063303590848521377345086649","156612576977805720926326267274001843127","242232523277758845861218909801446508929","3015925618677802107704455227780401897","122948689305040338757574057670738712175"],"threshold":0.9},"id":"CVE-2025-55297-288feee6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99","target":{"function":"blufi_aes_decrypt","file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"function_hash":"245315487047378546250681581351188821101","length":340},"id":"CVE-2025-55297-2fbf435a"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84","target":{"function":"blufi_aes_encrypt","file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"function_hash":"148374765658899350929694388313723438628","length":340},"id":"CVE-2025-55297-31633149","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"175734929258255810412998393423740844326","length":2298},"id":"CVE-2025-55297-31ceb9f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d","target":{"function":"blufi_dh_negotiate_data_handler","file":"examples/bluetooth/blufi/main/blufi_security.c"}},{"source":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_security_init"},"deprecated":false,"digest":{"function_hash":"14725441456098670115516619737556179302","length":302},"id":"CVE-2025-55297-39fae00a","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-55297-3b2c97c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"76431154367445552284709138797959255010","length":6458}},{"id":"CVE-2025-55297-3e3d59cb","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"line_hashes":["331085582535187419312669822313643256965","53280089156829210102589430749821973233","66895631876915309861787544348224261266","255328099612524442794757175403486629986","107411516224373670792224413698744463659","290672867258660951153969341466147841092","315298965330385692252646691338231720439","237769193488741412837818091658366218210","64564447095901283280977959803705123007","282893786190011153348779993857997488423","1773399234369843911083680917736783217","167832072059108668665289574497882621108","158136300225517230591717742470204375658","284851961722471322760438115313934715542","160283916475820659823012896819183694794","116477153524842790203027684448068635436","36485641714094567203105192577993181147","139552526746762588164594227841489114670","265355326638851894862345915353688477286","22765400381394925324899167413125436737","336136338496401826162053598069532485784","296431503006548955940805791929661303055","245453214213298609701237717330392100254","299081461237806767867009715687590316788","161855082983536272759085928800850997066","245453214213298609701237717330392100254","299081461237806767867009715687590316788","278416689349687702853168482721342856062","264117386686085264674729736361823270112","100211741724063303590848521377345086649","156612576977805720926326267274001843127","242232523277758845861218909801446508929","3015925618677802107704455227780401897","122948689305040338757574057670738712175"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["211932293721256966202710578094585543330","28187307207019347713287212980142431898","56313507085585402283193128946025108122","225792548284340363886924199780993309268","169639000018978717495728407573969511779","299000735249834920223846289490553666550","22471409609182823546259449643713415933","114025027611314480478009903225236664309","115088564007000263176049068429865578728","167511726988577124144650172376153237830","201093296828010501114284909415942315991","194398000043691101049808631408176113440","87444791817345919612377931340250762870"]},"id":"CVE-2025-55297-3ff0bed9"},{"deprecated":false,"digest":{"function_hash":"245315487047378546250681581351188821101","length":340},"id":"CVE-2025-55297-42060f15","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_decrypt"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f","target":{"function":"blufi_dh_negotiate_data_handler","file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"function_hash":"335337186792001548091255317629066027526","length":2727},"id":"CVE-2025-55297-45e66d10","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"140653178529060812317912478216494880203","length":5598},"id":"CVE-2025-55297-4ae7a2ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"}},{"source":"https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"140653178529060812317912478216494880203","length":5598},"id":"CVE-2025-55297-4cb0e6b7","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"},"deprecated":false,"digest":{"function_hash":"335337186792001548091255317629066027526","length":2727},"id":"CVE-2025-55297-4cc53be8","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-55297-4d6b7761","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"76431154367445552284709138797959255010","length":6458}},{"deprecated":false,"digest":{"function_hash":"175734929258255810412998393423740844326","length":2298},"id":"CVE-2025-55297-50c067fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"}},{"id":"CVE-2025-55297-513f2102","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_decrypt"},"deprecated":false,"digest":{"function_hash":"245315487047378546250681581351188821101","length":340}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"},"deprecated":false,"digest":{"function_hash":"175734929258255810412998393423740844326","length":2298},"id":"CVE-2025-55297-5a4ef79e"},{"id":"CVE-2025-55297-5c56fd99","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345","target":{"function":"blufi_dh_negotiate_data_handler","file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"function_hash":"175734929258255810412998393423740844326","length":2298}},{"target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_security_init"},"deprecated":false,"digest":{"function_hash":"14725441456098670115516619737556179302","length":302},"id":"CVE-2025-55297-634f154b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84"},{"source":"https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"line_hashes":["211932293721256966202710578094585543330","28187307207019347713287212980142431898","56313507085585402283193128946025108122","225792548284340363886924199780993309268","169639000018978717495728407573969511779","299000735249834920223846289490553666550","22471409609182823546259449643713415933","114025027611314480478009903225236664309","115088564007000263176049068429865578728","167511726988577124144650172376153237830","201093296828010501114284909415942315991","194398000043691101049808631408176113440","87444791817345919612377931340250762870"],"threshold":0.9},"id":"CVE-2025-55297-63d7afef","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["29039981224877963998942630998338717606","159372147770011671840714577430026889277","84532245823174355232518618886198842040","252303157452051750276356100548959233160"],"threshold":0.9},"id":"CVE-2025-55297-65fdb14d","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"}},{"deprecated":false,"digest":{"line_hashes":["29039981224877963998942630998338717606","159372147770011671840714577430026889277","84532245823174355232518618886198842040","252303157452051750276356100548959233160"],"threshold":0.9},"id":"CVE-2025-55297-6d462cd8","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"140653178529060812317912478216494880203","length":5598},"id":"CVE-2025-55297-6f0a8303","signature_type":"Function"},{"id":"CVE-2025-55297-7ae4ba95","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"},"deprecated":false,"digest":{"line_hashes":["29039981224877963998942630998338717606","159372147770011671840714577430026889277","84532245823174355232518618886198842040","252303157452051750276356100548959233160"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["211932293721256966202710578094585543330","28187307207019347713287212980142431898","56313507085585402283193128946025108122","225792548284340363886924199780993309268","169639000018978717495728407573969511779","299000735249834920223846289490553666550","22471409609182823546259449643713415933","114025027611314480478009903225236664309","115088564007000263176049068429865578728","167511726988577124144650172376153237830","201093296828010501114284909415942315991","194398000043691101049808631408176113440","87444791817345919612377931340250762870"]},"id":"CVE-2025-55297-7c4780c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false},{"digest":{"function_hash":"335337186792001548091255317629066027526","length":2727},"id":"CVE-2025-55297-8582f2e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["211932293721256966202710578094585543330","28187307207019347713287212980142431898","56313507085585402283193128946025108122","225792548284340363886924199780993309268","169639000018978717495728407573969511779","299000735249834920223846289490553666550","22471409609182823546259449643713415933","114025027611314480478009903225236664309","115088564007000263176049068429865578728","167511726988577124144650172376153237830","201093296828010501114284909415942315991","194398000043691101049808631408176113440","87444791817345919612377931340250762870"],"threshold":0.9},"id":"CVE-2025-55297-8a7eb3c3","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"}},{"deprecated":false,"digest":{"function_hash":"148374765658899350929694388313723438628","length":340},"id":"CVE-2025-55297-9309652b","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_encrypt"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"line_hashes":["331085582535187419312669822313643256965","53280089156829210102589430749821973233","66895631876915309861787544348224261266","255328099612524442794757175403486629986","107411516224373670792224413698744463659","290672867258660951153969341466147841092","315298965330385692252646691338231720439","237769193488741412837818091658366218210","64564447095901283280977959803705123007","282893786190011153348779993857997488423","1773399234369843911083680917736783217","167832072059108668665289574497882621108","158136300225517230591717742470204375658","284851961722471322760438115313934715542","160283916475820659823012896819183694794","116477153524842790203027684448068635436","36485641714094567203105192577993181147","139552526746762588164594227841489114670","265355326638851894862345915353688477286","22765400381394925324899167413125436737","336136338496401826162053598069532485784","296431503006548955940805791929661303055","245453214213298609701237717330392100254","299081461237806767867009715687590316788","161855082983536272759085928800850997066","245453214213298609701237717330392100254","299081461237806767867009715687590316788","278416689349687702853168482721342856062","264117386686085264674729736361823270112","100211741724063303590848521377345086649","156612576977805720926326267274001843127","242232523277758845861218909801446508929","3015925618677802107704455227780401897","122948689305040338757574057670738712175"],"threshold":0.9},"id":"CVE-2025-55297-93514243","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"},"deprecated":false,"digest":{"function_hash":"335337186792001548091255317629066027526","length":2727},"id":"CVE-2025-55297-99a3a9fb"},{"deprecated":false,"digest":{"function_hash":"245315487047378546250681581351188821101","length":340},"id":"CVE-2025-55297-9b1f4d5a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_decrypt"}},{"deprecated":false,"digest":{"function_hash":"140653178529060812317912478216494880203","length":5598},"id":"CVE-2025-55297-9c445961","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"}},{"deprecated":false,"digest":{"function_hash":"14725441456098670115516619737556179302","length":302},"id":"CVE-2025-55297-a6674be1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_security_init"}},{"id":"CVE-2025-55297-ab7017a1","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"line_hashes":["331085582535187419312669822313643256965","53280089156829210102589430749821973233","66895631876915309861787544348224261266","255328099612524442794757175403486629986","107411516224373670792224413698744463659","290672867258660951153969341466147841092","315298965330385692252646691338231720439","237769193488741412837818091658366218210","64564447095901283280977959803705123007","282893786190011153348779993857997488423","1773399234369843911083680917736783217","167832072059108668665289574497882621108","158136300225517230591717742470204375658","284851961722471322760438115313934715542","160283916475820659823012896819183694794","116477153524842790203027684448068635436","36485641714094567203105192577993181147","139552526746762588164594227841489114670","265355326638851894862345915353688477286","22765400381394925324899167413125436737","336136338496401826162053598069532485784","296431503006548955940805791929661303055","245453214213298609701237717330392100254","299081461237806767867009715687590316788","161855082983536272759085928800850997066","245453214213298609701237717330392100254","299081461237806767867009715687590316788","278416689349687702853168482721342856062","264117386686085264674729736361823270112","100211741724063303590848521377345086649","156612576977805720926326267274001843127","242232523277758845861218909801446508929","3015925618677802107704455227780401897","122948689305040338757574057670738712175"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["29039981224877963998942630998338717606","159372147770011671840714577430026889277","84532245823174355232518618886198842040","252303157452051750276356100548959233160"],"threshold":0.9},"id":"CVE-2025-55297-b0e1715e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"}},{"target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_decrypt"},"deprecated":false,"digest":{"function_hash":"245315487047378546250681581351188821101","length":340},"id":"CVE-2025-55297-b2229829","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f40aa9c587a8e570dfde2e6330382dcd170d5a5d"},{"id":"CVE-2025-55297-b364d98c","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"76431154367445552284709138797959255010","length":6458}},{"deprecated":false,"digest":{"function_hash":"175734929258255810412998393423740844326","length":2298},"id":"CVE-2025-55297-b724b30e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"}},{"target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"76431154367445552284709138797959255010","length":6458},"id":"CVE-2025-55297-b9b74424","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501"},{"id":"CVE-2025-55297-bab256e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_aes_encrypt"},"deprecated":false,"digest":{"function_hash":"148374765658899350929694388313723438628","length":340}},{"id":"CVE-2025-55297-bbb01db7","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"},"deprecated":false,"digest":{"line_hashes":["29039981224877963998942630998338717606","159372147770011671840714577430026889277","84532245823174355232518618886198842040","252303157452051750276356100548959233160"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/bf50c0c197af30990026c8f8286298d2aa5a3c99","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"},"deprecated":false,"digest":{"function_hash":"335337186792001548091255317629066027526","length":2727},"id":"CVE-2025-55297-ceaaa8e2","signature_type":"Function"},{"id":"CVE-2025-55297-d57bcaa1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"},"deprecated":false,"digest":{"function_hash":"175734929258255810412998393423740844326","length":2298}},{"id":"CVE-2025-55297-da985474","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/cc00e9f2fc4f7e8fbaff27851b4a8b45fa483501","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"line_hashes":["331085582535187419312669822313643256965","53280089156829210102589430749821973233","66895631876915309861787544348224261266","255328099612524442794757175403486629986","107411516224373670792224413698744463659","290672867258660951153969341466147841092","315298965330385692252646691338231720439","237769193488741412837818091658366218210","64564447095901283280977959803705123007","282893786190011153348779993857997488423","1773399234369843911083680917736783217","167832072059108668665289574497882621108","158136300225517230591717742470204375658","284851961722471322760438115313934715542","160283916475820659823012896819183694794","116477153524842790203027684448068635436","36485641714094567203105192577993181147","139552526746762588164594227841489114670","265355326638851894862345915353688477286","22765400381394925324899167413125436737","336136338496401826162053598069532485784","296431503006548955940805791929661303055","245453214213298609701237717330392100254","299081461237806767867009715687590316788","161855082983536272759085928800850997066","245453214213298609701237717330392100254","299081461237806767867009715687590316788","278416689349687702853168482721342856062","264117386686085264674729736361823270112","100211741724063303590848521377345086649","156612576977805720926326267274001843127","242232523277758845861218909801446508929","3015925618677802107704455227780401897","122948689305040338757574057670738712175"],"threshold":0.9}},{"target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"},"deprecated":false,"digest":{"line_hashes":["156718069195225552601309518493754853400","4651273288141566203432787391121677576","5450208424883404953253788947636113072","212250662498059847845573964628673736154","140443780821930965946982575988969922783","125483958846573307628727124779218251622","192589945895917643578248128019074152363","23025681073281916378065892596205255988","265090150793358509237187042393682248086","98850339263440219764764085097559643670","28706277393444943867421732117850720742","319014018412117820981892491866096122588","11535038317845881545672410981899497224","132299173107655464416739961996593942283","62475831688793100973146978827325373036","239959748408126982566592479045931394852","312409216813545517587353631923860324521","177367434480545604463513578326446377267"],"threshold":0.9},"id":"CVE-2025-55297-de948eb3","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d"},{"digest":{"threshold":0.9,"line_hashes":["156718069195225552601309518493754853400","4651273288141566203432787391121677576","5450208424883404953253788947636113072","212250662498059847845573964628673736154","140443780821930965946982575988969922783","125483958846573307628727124779218251622","192589945895917643578248128019074152363","23025681073281916378065892596205255988","265090150793358509237187042393682248086","98850339263440219764764085097559643670","28706277393444943867421732117850720742","319014018412117820981892491866096122588","11535038317845881545672410981899497224","132299173107655464416739961996593942283","62475831688793100973146978827325373036","239959748408126982566592479045931394852","312409216813545517587353631923860324521","177367434480545604463513578326446377267"]},"id":"CVE-2025-55297-e0174993","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"},"deprecated":false},{"id":"CVE-2025-55297-e3293d38","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"line_hashes":["211932293721256966202710578094585543330","28187307207019347713287212980142431898","56313507085585402283193128946025108122","225792548284340363886924199780993309268","169639000018978717495728407573969511779","299000735249834920223846289490553666550","22471409609182823546259449643713415933","114025027611314480478009903225236664309","115088564007000263176049068429865578728","167511726988577124144650172376153237830","201093296828010501114284909415942315991","194398000043691101049808631408176113440","87444791817345919612377931340250762870"],"threshold":0.9}},{"digest":{"line_hashes":["331085582535187419312669822313643256965","53280089156829210102589430749821973233","66895631876915309861787544348224261266","255328099612524442794757175403486629986","107411516224373670792224413698744463659","290672867258660951153969341466147841092","315298965330385692252646691338231720439","237769193488741412837818091658366218210","64564447095901283280977959803705123007","282893786190011153348779993857997488423","1773399234369843911083680917736783217","167832072059108668665289574497882621108","158136300225517230591717742470204375658","284851961722471322760438115313934715542","160283916475820659823012896819183694794","116477153524842790203027684448068635436","36485641714094567203105192577993181147","139552526746762588164594227841489114670","265355326638851894862345915353688477286","22765400381394925324899167413125436737","336136338496401826162053598069532485784","296431503006548955940805791929661303055","245453214213298609701237717330392100254","299081461237806767867009715687590316788","161855082983536272759085928800850997066","245453214213298609701237717330392100254","299081461237806767867009715687590316788","278416689349687702853168482721342856062","264117386686085264674729736361823270112","100211741724063303590848521377345086649","156612576977805720926326267274001843127","242232523277758845861218909801446508929","3015925618677802107704455227780401897","122948689305040338757574057670738712175"],"threshold":0.9},"id":"CVE-2025-55297-ef87a9d8","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false},{"id":"CVE-2025-55297-eff8fce2","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"140653178529060812317912478216494880203","length":5598}},{"source":"https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c"},"deprecated":false,"digest":{"line_hashes":["211932293721256966202710578094585543330","28187307207019347713287212980142431898","56313507085585402283193128946025108122","225792548284340363886924199780993309268","169639000018978717495728407573969511779","299000735249834920223846289490553666550","22471409609182823546259449643713415933","114025027611314480478009903225236664309","115088564007000263176049068429865578728","167511726988577124144650172376153237830","201093296828010501114284909415942315991","194398000043691101049808631408176113440","87444791817345919612377931340250762870"],"threshold":0.9},"id":"CVE-2025-55297-f07dd7aa","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["156718069195225552601309518493754853400","4651273288141566203432787391121677576","5450208424883404953253788947636113072","212250662498059847845573964628673736154","140443780821930965946982575988969922783","125483958846573307628727124779218251622","192589945895917643578248128019074152363","23025681073281916378065892596205255988","265090150793358509237187042393682248086","98850339263440219764764085097559643670","28706277393444943867421732117850720742","319014018412117820981892491866096122588","11535038317845881545672410981899497224","132299173107655464416739961996593942283","62475831688793100973146978827325373036","239959748408126982566592479045931394852","312409216813545517587353631923860324521","177367434480545604463513578326446377267"],"threshold":0.9},"id":"CVE-2025-55297-f3e24ac7","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"}},{"id":"CVE-2025-55297-f4bef7c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"},"deprecated":false,"digest":{"line_hashes":["156718069195225552601309518493754853400","4651273288141566203432787391121677576","5450208424883404953253788947636113072","212250662498059847845573964628673736154","140443780821930965946982575988969922783","125483958846573307628727124779218251622","192589945895917643578248128019074152363","23025681073281916378065892596205255988","265090150793358509237187042393682248086","287347430840468246038638054527124678212","303432543401372844844901516707360859542","182481930880507031452989989164542119878","28706277393444943867421732117850720742","319014018412117820981892491866096122588","11535038317845881545672410981899497224","132299173107655464416739961996593942283","62475831688793100973146978827325373036","239959748408126982566592479045931394852","312409216813545517587353631923860324521","177367434480545604463513578326446377267"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84","target":{"file":"examples/bluetooth/blufi/main/blufi_security.c","function":"blufi_dh_negotiate_data_handler"},"deprecated":false,"digest":{"function_hash":"335337186792001548091255317629066027526","length":2727},"id":"CVE-2025-55297-f4f0ef83","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c","function":"example_event_callback"},"deprecated":false,"digest":{"function_hash":"76431154367445552284709138797959255010","length":6458},"id":"CVE-2025-55297-f68124a7","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["29039981224877963998942630998338717606","159372147770011671840714577430026889277","84532245823174355232518618886198842040","252303157452051750276356100548959233160"],"threshold":0.9},"id":"CVE-2025-55297-f722f38b","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/b1657d9dd4d0e48ed25e02cb8fe8413f479a2a84","target":{"file":"examples/bluetooth/blufi/main/blufi_example_main.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"}]}