{"id":"CVE-2026-45542","summary":"ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth","details":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a username and copies it into a buffer whose size is derived from a narrower destination type. The resulting truncation-versus-copy asymmetry corrupts the heap when an oversized value is supplied. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.","aliases":["GHSA-9r76-858f-v6jh"],"modified":"2026-10-28T11:11:05.684221979Z","published":"2026-06-10T00:34:53.238Z","database_specific":{"cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45542.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45542.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-9r76-858f-v6jh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45542"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"9ef24e3e2a2c96e720d83c574a3f8699177573da"},{"fixed":"0ea58d79845ad674d0358d5de246015a68c4cb4f"},{"fixed":"56c3e385611e63162d0f2f8504ac4ae2ccfccef0"},{"fixed":"71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"fixed":"9b4cacf9cbc69379972de6a2247fcf5af9240961"},{"fixed":"a2f4554f10ba075c98cbc67464db096ba32497cf"},{"fixed":"f5d24a7e919bc5f447091479656b86da6762a103"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"= 5.2.6"},{"last_affected":"= 5.2.6"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"= 5.3.5"},{"last_affected":"= 5.3.5"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"= 5.4.4"},{"last_affected":"= 5.4.4"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"= 5.5.4"},{"last_affected":"= 5.5.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"= 6.0"},{"last_affected":"= 6.0"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"0ea58d79845ad674d0358d5de246015a68c4cb4f"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"56c3e385611e63162d0f2f8504ac4ae2ccfccef0"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"71eb2dbe6aaef830719ecac8edf409e2992b64b2"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"9b4cacf9cbc69379972de6a2247fcf5af9240961"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a2f4554f10ba075c98cbc67464db096ba32497cf"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"f5d24a7e919bc5f447091479656b86da6762a103"}]}]}}],"versions":["5.2.6","5.3.5","5.4.4","5.5.4","6.0","= 5.2.6","= 5.3.5","= 5.4.4","= 5.5.4","= 6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45542.json","vanir_signatures":[{"id":"CVE-2026-45542-030787cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"66637516235798520583836404807583978754","length":3912}},{"id":"CVE-2026-45542-031ee1bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","104801840341733166631837103980755435953","12855391817215289900226937417952629672","164768678214919202410182532196504737720","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"]}},{"target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"],"threshold":0.9},"id":"CVE-2026-45542-03e21a6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103"},{"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-0ba60fcd","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security1.c"}},{"id":"CVE-2026-45542-1397c8c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"]}},{"target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-171f854c","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f"},{"target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"291778986405942034007546822370616589416","length":4448},"id":"CVE-2026-45542-19648e30","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961"},{"digest":{"function_hash":"223536219045440876253511494779194151885","length":5369},"id":"CVE-2026-45542-1b095396","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"function":"handle_session_command0","file":"components/protocomm/src/security/security1.c"},"deprecated":false},{"id":"CVE-2026-45542-1c305eff","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"]}},{"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-20f6c379","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security1.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"66637516235798520583836404807583978754","length":3912},"id":"CVE-2026-45542-2119065f","signature_type":"Function"},{"id":"CVE-2026-45542-22eeb15e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"204250153388322770848330902332628700526","length":3356}},{"deprecated":false,"digest":{"length":4688,"function_hash":"87271462341320497684693964138173302126"},"id":"CVE-2026-45542-2372fea1","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"}},{"digest":{"threshold":0.9,"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"]},"id":"CVE-2026-45542-29630d10","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","104801840341733166631837103980755435953","12855391817215289900226937417952629672","164768678214919202410182532196504737720","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9},"id":"CVE-2026-45542-2d7716f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security2.c"}},{"target":{"function":"handle_session_command1","file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"function_hash":"204250153388322770848330902332628700526","length":3356},"id":"CVE-2026-45542-36eee674","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0"},{"source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"87271462341320497684693964138173302126","length":4688},"id":"CVE-2026-45542-388b7265","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"function":"handle_session_command1","file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"function_hash":"204250153388322770848330902332628700526","length":3356},"id":"CVE-2026-45542-422e1d22"},{"source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command1"},"deprecated":false,"digest":{"length":3912,"function_hash":"66637516235798520583836404807583978754"},"id":"CVE-2026-45542-46e43108","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"223536219045440876253511494779194151885","length":5369},"id":"CVE-2026-45542-47ccb753"},{"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-4a120e74","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"function":"handle_session_command0","file":"components/protocomm/src/security/security2.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"183766873230718209336473706934289265519","length":3481},"id":"CVE-2026-45542-4a2ca94e","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"function":"handle_session_command1","file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"length":3912,"function_hash":"66637516235798520583836404807583978754"},"id":"CVE-2026-45542-4a71f657","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"]},"id":"CVE-2026-45542-52f59508","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security1.c","function":"sec1_req_handler"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-68079c39"},{"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9},"id":"CVE-2026-45542-7008a3cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"},"deprecated":false,"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-7c0d9be3"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"]},"id":"CVE-2026-45542-7ce94e08","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security1.c"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"},"deprecated":false,"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-9abffe5f","signature_type":"Function"},{"source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false,"digest":{"length":5369,"function_hash":"223536219045440876253511494779194151885"},"id":"CVE-2026-45542-9b0a8db6","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"291778986405942034007546822370616589416","length":4448},"id":"CVE-2026-45542-9c0a65a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security1.c","function":"handle_session_command0"},"deprecated":false},{"target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"length":4112,"function_hash":"71005990062231931980358509090582854648"},"id":"CVE-2026-45542-9d4497cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"204250153388322770848330902332628700526","length":3356},"id":"CVE-2026-45542-a1adac9a"},{"id":"CVE-2026-45542-a66427a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/protocomm/src/security/security1.c","function":"sec1_req_handler"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322}},{"source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","13697352475489562871465773862785742637","273746855842934768488927238453882862702","39237291785320425519940417583372049919","278248884436414595766497304803495653292","141494834724323226474815268400120414915","115592113862586847264517258495527512850","60642355015105531142184602057485525562","233838646533457620023491698430261770172","54171944180825270306620377220468869211","131393921808815503442197909735008397591","199997960049333816980116702779195050204","11008475821056786179527368070442488398","42062047691632535235721011924170989522","191197144476338073590583860248495215046","49203325046158456318644597283730862842","286346987763872458534344320349256393375","129558991831843771427033777233893830326","178912916035348202198452320151291494346","56138674746168054615722463919633841385"],"threshold":0.9},"id":"CVE-2026-45542-a6afb3c1","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"function":"handle_session_command0","file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"function_hash":"223536219045440876253511494779194151885","length":5369},"id":"CVE-2026-45542-adba30ba"},{"digest":{"threshold":0.9,"line_hashes":["258789193336565553558129560693305994792","314986403183807104215610778254465082389","331914707333590245266331099214247816856","197082307710005892702113781229223067870","115882509426882063156798737857418244590","48783316460964868554487013613599792969"]},"id":"CVE-2026-45542-b295d2a6","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false},{"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-b3499ead","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"function":"sec2_req_handler","file":"components/protocomm/src/security/security2.c"},"deprecated":false},{"id":"CVE-2026-45542-b6770011","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security1.c","function":"sec1_req_handler"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"function":"sec1_req_handler","file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-bc86de2c"},{"deprecated":false,"digest":{"line_hashes":["321189073728696965463177569112053558497","157489157259703187143966290248815678464","230331169111475247975252542541404274340","291198250202741885478163117188791494548"],"threshold":0.9},"id":"CVE-2026-45542-c1559679","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/mbedtls/port/include/mbedtls/esp_config.h"},"deprecated":false,"digest":{"line_hashes":["258789193336565553558129560693305994792","314986403183807104215610778254465082389","331914707333590245266331099214247816856","197082307710005892702113781229223067870","115882509426882063156798737857418244590","48783316460964868554487013613599792969"],"threshold":0.9},"id":"CVE-2026-45542-c7494659","signature_type":"Line"},{"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-cbe81c59","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"function":"sec2_req_handler","file":"components/protocomm/src/security/security2.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2","target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"]},"id":"CVE-2026-45542-d51b2578"},{"target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-d7ea7136","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f"},{"target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"length":4237,"function_hash":"137143555355116739810665479923994377905"},"id":"CVE-2026-45542-e32c80a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"target":{"file":"components/protocomm/src/security/security1.c","function":"sec1_req_handler"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-e864a31e","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command1"},"deprecated":false,"digest":{"function_hash":"183766873230718209336473706934289265519","length":3481},"id":"CVE-2026-45542-e931c10e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-eae90b84"},{"target":{"function":"sec1_req_handler","file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"function_hash":"220321280194033903242401789514571857069","length":1322},"id":"CVE-2026-45542-ec8aaff0","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0"},{"digest":{"function_hash":"161685405431829692005481439455685208075","length":1322},"id":"CVE-2026-45542-f3e46261","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103","target":{"file":"components/protocomm/src/security/security2.c","function":"sec2_req_handler"},"deprecated":false},{"target":{"function":"sec2_req_handler","file":"components/protocomm/src/security/security2.c"},"deprecated":false,"digest":{"length":1322,"function_hash":"161685405431829692005481439455685208075"},"id":"CVE-2026-45542-fd721c36","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf"},{"source":"https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0","target":{"file":"components/protocomm/src/security/security2.c","function":"handle_session_command0"},"deprecated":false,"digest":{"function_hash":"71005990062231931980358509090582854648","length":4112},"id":"CVE-2026-45542-fe0b950c","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961","target":{"file":"components/protocomm/src/security/security1.c"},"deprecated":false,"digest":{"line_hashes":["38599976760887309718564177547076639349","122921837595916614429287090918435470191","158307852764559595536495513358596307718","227719143938806643552088228333031112127","254461542196862791975914989128261930819","135516208060193955924103971132656288599","17303036144169493564467096199268722713","73147217691436512037823382139202767421","286346987763872458534344320349256393375","129558991831843771427033777233893830326","112672983547878983325999939125066159515","269424886357760685924907219156106003826"],"threshold":0.9},"id":"CVE-2026-45542-fea48b56","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-28T11:11:05Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}]}