{"id":"CVE-2026-45542","summary":"ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a username and copies it into a buffer whose size is derived from a narrower destination type. The resulting truncation-versus-copy asymmetry corrupts the heap when an oversized value is supplied. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.","aliases":["GHSA-9r76-858f-v6jh"],"modified":"2026-08-12T16:24:39.402392Z","published":"2026-06-10T00:34:53.238Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45542.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45542.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-9r76-858f-v6jh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45542"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"9ef24e3e2a2c96e720d83c574a3f8699177573da"},{"fixed":"0ea58d79845ad674d0358d5de246015a68c4cb4f"},{"fixed":"56c3e385611e63162d0f2f8504ac4ae2ccfccef0"},{"fixed":"71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"fixed":"9b4cacf9cbc69379972de6a2247fcf5af9240961"},{"fixed":"a2f4554f10ba075c98cbc67464db096ba32497cf"},{"fixed":"f5d24a7e919bc5f447091479656b86da6762a103"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.2.6"},{"last_affected":"5.2.6"},{"introduced":"5.3.5"},{"last_affected":"5.3.5"},{"introduced":"5.4.4"},{"last_affected":"5.4.4"},{"introduced":"5.5.4"},{"last_affected":"5.5.4"},{"introduced":"6.0"},{"last_affected":"6.0"}]}}],"versions":["5.2.6","5.3.5","5.4.4","5.5.4","6.0","= 5.2.6","= 5.3.5","= 5.4.4","= 5.5.4","= 6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45542.json","vanir_signatures_modified":"2026-08-12T16:24:39Z","vanir_signatures":[{"source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"66637516235798520583836404807583978754","length":3912},"id":"CVE-2026-45542-030787cd","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","104801840341733166631837103980755435953","12855391817215289900226937417952629672","164768678214919202410182532196504737720","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9},"id":"CVE-2026-45542-031ee1bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security2.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"],"threshold":0.9},"id":"CVE-2026-45542-03e21a6e"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-0ba60fcd","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"]},"id":"CVE-2026-45542-1397c8c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security2.c"}},{"source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-171f854c","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"291778986405942034007546822370616589416","length":4448},"id":"CVE-2026-45542-19648e30","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"223536219045440876253511494779194151885","length":5369},"id":"CVE-2026-45542-1b095396","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false},{"id":"CVE-2026-45542-1c305eff","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9}},{"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-20f6c379","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false},{"digest":{"function_hash":"66637516235798520583836404807583978754","length":3912},"id":"CVE-2026-45542-2119065f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"204250153388322770848330902332628700526","length":3356},"id":"CVE-2026-45542-22eeb15e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"}},{"source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"87271462341320497684693964138173302126","length":4688},"id":"CVE-2026-45542-2372fea1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"],"threshold":0.9},"id":"CVE-2026-45542-29630d10","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","104801840341733166631837103980755435953","12855391817215289900226937417952629672","164768678214919202410182532196504737720","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9},"id":"CVE-2026-45542-2d7716f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security2.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"204250153388322770848330902332628700526","length":3356},"id":"CVE-2026-45542-36eee674"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"87271462341320497684693964138173302126","length":4688},"id":"CVE-2026-45542-388b7265","signature_type":"Function"},{"deprecated":false,"digest":{"length":3356,"function_hash":"204250153388322770848330902332628700526"},"id":"CVE-2026-45542-422e1d22","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"}},{"digest":{"function_hash":"66637516235798520583836404807583978754","length":3912},"id":"CVE-2026-45542-46e43108","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"function":"handle_session_command1","file":"components/protocomm/src/security/security1.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"223536219045440876253511494779194151885","length":5369},"id":"CVE-2026-45542-47ccb753"},{"source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-4a120e74","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-45542-4a2ca94e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"function":"handle_session_command1","file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"function_hash":"183766873230718209336473706934289265519","length":3481}},{"source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"66637516235798520583836404807583978754","length":3912},"id":"CVE-2026-45542-4a71f657","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"]},"id":"CVE-2026-45542-52f59508","signature_type":"Line","signature_version":"v1"},{"target":{"function":"sec1_req_handler","file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-68079c39","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9},"id":"CVE-2026-45542-7008a3cc","signature_type":"Line"},{"target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"},"deprecated":false,"digest":{"length":1322,"function_hash":"161685405431829692005481439455685208075"},"id":"CVE-2026-45542-7c0d9be3","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-7ce94e08","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security1.c"}},{"id":"CVE-2026-45542-9abffe5f","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"function":"sec2_req_handler","file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"length":1322,"function_hash":"161685405431829692005481439455685208075"}},{"deprecated":false,"digest":{"function_hash":"223536219045440876253511494779194151885","length":5369},"id":"CVE-2026-45542-9b0a8db6","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"function":"handle_session_command0","file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"length":4448,"function_hash":"291778986405942034007546822370616589416"},"id":"CVE-2026-45542-9c0a65a2"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-9d4497cd"},{"target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"204250153388322770848330902332628700526","length":3356},"id":"CVE-2026-45542-a1adac9a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"function":"sec1_req_handler","file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-a66427a0","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9},"id":"CVE-2026-45542-a6afb3c1","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-45542-adba30ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"223536219045440876253511494779194151885","length":5369}},{"target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"line_hashes":["258789193336565553558129560693305994792","314986403183807104215610778254465082389","331914707333590245266331099214247816856","197082307710005892702113781229223067870","115882509426882063156798737857418244590","48783316460964868554487013613599792969"],"threshold":0.9},"id":"CVE-2026-45542-b295d2a6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf"},{"deprecated":false,"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-b3499ead","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"}},{"target":{"file":"components/protocomm/src/security/security1.c","function":"sec1_req_handler"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-b6770011","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961"},{"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-bc86de2c","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"function":"sec1_req_handler","file":"components/protocomm/src/security/security1.c"}},{"id":"CVE-2026-45542-c1559679","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"line_hashes":["258789193336565553558129560693305994792","314986403183807104215610778254465082389","331914707333590245266331099214247816856","197082307710005892702113781229223067870","115882509426882063156798737857418244590","48783316460964868554487013613599792969"],"threshold":0.9},"id":"CVE-2026-45542-c7494659"},{"id":"CVE-2026-45542-cbe81c59","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"},"deprecated":false,"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322}},{"id":"CVE-2026-45542-d51b2578","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9}},{"source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-d7ea7136","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"137143555355116739810665479923994377905","length":4237},"id":"CVE-2026-45542-e32c80a8","signature_type":"Function"},{"target":{"file":"components/protocomm/src/security/security1.c","function":"sec1_req_handler"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-e864a31e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"183766873230718209336473706934289265519","length":3481},"id":"CVE-2026-45542-e931c10e","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-eae90b84","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"}},{"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-ec8aaff0","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security1.c","function":"sec1_req_handler"}},{"source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"},"deprecated":false,"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-f3e46261","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-fd721c36","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"}},{"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-fe0b950c","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"function":"handle_session_command0","file":"components/protocomm/src/security/security2.c"}},{"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-fea48b56","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}]}