CVE-2026-45542

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45542

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45542.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45542

Aliases

GHSA-9r76-858f-v6jh

Published

2026-06-10T00:34:53.238Z

Modified

2026-07-26T03:40:50.375294Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

Summary

ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth

Details

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handlesessioncommand0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a username and copies it into a buffer whose size is derived from a narrower destination type. The resulting truncation-versus-copy asymmetry corrupts the heap when an oversized value is supplied. This issue has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.

Database specific

{
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45542.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type

GIT

Repo

https://github.com/espressif/esp-idf

Events

Introduced

9ef24e3e2a2c96e720d83c574a3f8699177573da

Fixed

0ea58d79845ad674d0358d5de246015a68c4cb4f

Fixed

56c3e385611e63162d0f2f8504ac4ae2ccfccef0

Fixed

71eb2dbe6aaef830719ecac8edf409e2992b64b2

Fixed

9b4cacf9cbc69379972de6a2247fcf5af9240961

Fixed

a2f4554f10ba075c98cbc67464db096ba32497cf

Fixed

f5d24a7e919bc5f447091479656b86da6762a103

Database specific

{
    "cpe": [
        "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.3.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.4.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.5.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:6.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "5.2.6"
        },
        {
            "last_affected": "5.2.6"
        },
        {
            "introduced": "5.3.5"
        },
        {
            "last_affected": "5.3.5"
        },
        {
            "introduced": "5.4.4"
        },
        {
            "last_affected": "5.4.4"
        },
        {
            "introduced": "5.5.4"
        },
        {
            "last_affected": "5.5.4"
        },
        {
            "introduced": "6.0"
        },
        {
            "last_affected": "6.0"
        }
    ]
}

Affected versions

5.*

5.2.6

5.3.5

5.4.4

5.5.4

6.*

6.0

= 5.*

= 5.2.6

= 5.3.5

= 5.4.4

= 5.5.4

= 6.*

= 6.0

Database specific

vanir_signatures_modified

"2026-07-26T03:40:50Z"

vanir_signatures

[
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-030787cd",
        "signature_version": "v1",
        "digest": {
            "function_hash": "66637516235798520583836404807583978754",
            "length": 3912.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security2.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-031ee1bd",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "13697352475489562871465773862785742637",
                "273746855842934768488927238453882862702",
                "39237291785320425519940417583372049919",
                "278248884436414595766497304803495653292",
                "141494834724323226474815268400120414915",
                "115592113862586847264517258495527512850",
                "60642355015105531142184602057485525562",
                "233838646533457620023491698430261770172",
                "54171944180825270306620377220468869211",
                "131393921808815503442197909735008397591",
                "199997960049333816980116702779195050204",
                "11008475821056786179527368070442488398",
                "104801840341733166631837103980755435953",
                "12855391817215289900226937417952629672",
                "164768678214919202410182532196504737720",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "178912916035348202198452320151291494346",
                "56138674746168054615722463919633841385"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/mbedtls/port/include/mbedtls/esp_config.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-03e21a6e",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "321189073728696965463177569112053558497",
                "157489157259703187143966290248815678464",
                "230331169111475247975252542541404274340",
                "291198250202741885478163117188791494548"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security1.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-0ba60fcd",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "122921837595916614429287090918435470191",
                "158307852764559595536495513358596307718",
                "227719143938806643552088228333031112127",
                "254461542196862791975914989128261930819",
                "135516208060193955924103971132656288599",
                "17303036144169493564467096199268722713",
                "73147217691436512037823382139202767421",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "112672983547878983325999939125066159515",
                "269424886357760685924907219156106003826"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security2.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-1397c8c0",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "13697352475489562871465773862785742637",
                "273746855842934768488927238453882862702",
                "39237291785320425519940417583372049919",
                "278248884436414595766497304803495653292",
                "141494834724323226474815268400120414915",
                "115592113862586847264517258495527512850",
                "60642355015105531142184602057485525562",
                "233838646533457620023491698430261770172",
                "54171944180825270306620377220468869211",
                "131393921808815503442197909735008397591",
                "199997960049333816980116702779195050204",
                "11008475821056786179527368070442488398",
                "42062047691632535235721011924170989522",
                "191197144476338073590583860248495215046",
                "49203325046158456318644597283730862842",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "178912916035348202198452320151291494346",
                "56138674746168054615722463919633841385"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security1.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-171f854c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "122921837595916614429287090918435470191",
                "158307852764559595536495513358596307718",
                "227719143938806643552088228333031112127",
                "254461542196862791975914989128261930819",
                "135516208060193955924103971132656288599",
                "17303036144169493564467096199268722713",
                "73147217691436512037823382139202767421",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "112672983547878983325999939125066159515",
                "269424886357760685924907219156106003826"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-19648e30",
        "signature_version": "v1",
        "digest": {
            "function_hash": "291778986405942034007546822370616589416",
            "length": 4448.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-1b095396",
        "signature_version": "v1",
        "digest": {
            "function_hash": "223536219045440876253511494779194151885",
            "length": 5369.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security2.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-1c305eff",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "13697352475489562871465773862785742637",
                "273746855842934768488927238453882862702",
                "39237291785320425519940417583372049919",
                "278248884436414595766497304803495653292",
                "141494834724323226474815268400120414915",
                "115592113862586847264517258495527512850",
                "60642355015105531142184602057485525562",
                "233838646533457620023491698430261770172",
                "54171944180825270306620377220468869211",
                "131393921808815503442197909735008397591",
                "199997960049333816980116702779195050204",
                "11008475821056786179527368070442488398",
                "42062047691632535235721011924170989522",
                "191197144476338073590583860248495215046",
                "49203325046158456318644597283730862842",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "178912916035348202198452320151291494346",
                "56138674746168054615722463919633841385"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security1.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-20f6c379",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "122921837595916614429287090918435470191",
                "158307852764559595536495513358596307718",
                "227719143938806643552088228333031112127",
                "254461542196862791975914989128261930819",
                "135516208060193955924103971132656288599",
                "17303036144169493564467096199268722713",
                "73147217691436512037823382139202767421",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "112672983547878983325999939125066159515",
                "269424886357760685924907219156106003826"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-2119065f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "66637516235798520583836404807583978754",
            "length": 3912.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-22eeb15e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "204250153388322770848330902332628700526",
            "length": 3356.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-2372fea1",
        "signature_version": "v1",
        "digest": {
            "function_hash": "87271462341320497684693964138173302126",
            "length": 4688.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/mbedtls/port/include/mbedtls/esp_config.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-29630d10",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "321189073728696965463177569112053558497",
                "157489157259703187143966290248815678464",
                "230331169111475247975252542541404274340",
                "291198250202741885478163117188791494548"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security2.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-2d7716f6",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "13697352475489562871465773862785742637",
                "273746855842934768488927238453882862702",
                "39237291785320425519940417583372049919",
                "278248884436414595766497304803495653292",
                "141494834724323226474815268400120414915",
                "115592113862586847264517258495527512850",
                "60642355015105531142184602057485525562",
                "233838646533457620023491698430261770172",
                "54171944180825270306620377220468869211",
                "131393921808815503442197909735008397591",
                "199997960049333816980116702779195050204",
                "11008475821056786179527368070442488398",
                "104801840341733166631837103980755435953",
                "12855391817215289900226937417952629672",
                "164768678214919202410182532196504737720",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "178912916035348202198452320151291494346",
                "56138674746168054615722463919633841385"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-36eee674",
        "signature_version": "v1",
        "digest": {
            "function_hash": "204250153388322770848330902332628700526",
            "length": 3356.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-388b7265",
        "signature_version": "v1",
        "digest": {
            "function_hash": "87271462341320497684693964138173302126",
            "length": 4688.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-422e1d22",
        "signature_version": "v1",
        "digest": {
            "function_hash": "204250153388322770848330902332628700526",
            "length": 3356.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-46e43108",
        "signature_version": "v1",
        "digest": {
            "function_hash": "66637516235798520583836404807583978754",
            "length": 3912.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-47ccb753",
        "signature_version": "v1",
        "digest": {
            "function_hash": "223536219045440876253511494779194151885",
            "length": 5369.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-4a120e74",
        "signature_version": "v1",
        "digest": {
            "function_hash": "71005990062231931980358509090582854648",
            "length": 4112.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-4a2ca94e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "183766873230718209336473706934289265519",
            "length": 3481.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-4a71f657",
        "signature_version": "v1",
        "digest": {
            "function_hash": "66637516235798520583836404807583978754",
            "length": 3912.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/mbedtls/port/include/mbedtls/esp_config.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-52f59508",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "321189073728696965463177569112053558497",
                "157489157259703187143966290248815678464",
                "230331169111475247975252542541404274340",
                "291198250202741885478163117188791494548"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "sec1_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-68079c39",
        "signature_version": "v1",
        "digest": {
            "function_hash": "220321280194033903242401789514571857069",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security2.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-7008a3cc",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "13697352475489562871465773862785742637",
                "273746855842934768488927238453882862702",
                "39237291785320425519940417583372049919",
                "278248884436414595766497304803495653292",
                "141494834724323226474815268400120414915",
                "115592113862586847264517258495527512850",
                "60642355015105531142184602057485525562",
                "233838646533457620023491698430261770172",
                "54171944180825270306620377220468869211",
                "131393921808815503442197909735008397591",
                "199997960049333816980116702779195050204",
                "11008475821056786179527368070442488398",
                "42062047691632535235721011924170989522",
                "191197144476338073590583860248495215046",
                "49203325046158456318644597283730862842",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "178912916035348202198452320151291494346",
                "56138674746168054615722463919633841385"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "sec2_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-7c0d9be3",
        "signature_version": "v1",
        "digest": {
            "function_hash": "161685405431829692005481439455685208075",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security1.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-7ce94e08",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "122921837595916614429287090918435470191",
                "158307852764559595536495513358596307718",
                "227719143938806643552088228333031112127",
                "254461542196862791975914989128261930819",
                "135516208060193955924103971132656288599",
                "17303036144169493564467096199268722713",
                "73147217691436512037823382139202767421",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "112672983547878983325999939125066159515",
                "269424886357760685924907219156106003826"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "sec2_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-9abffe5f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "161685405431829692005481439455685208075",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-9b0a8db6",
        "signature_version": "v1",
        "digest": {
            "function_hash": "223536219045440876253511494779194151885",
            "length": 5369.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-9c0a65a2",
        "signature_version": "v1",
        "digest": {
            "function_hash": "291778986405942034007546822370616589416",
            "length": 4448.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-9d4497cd",
        "signature_version": "v1",
        "digest": {
            "function_hash": "71005990062231931980358509090582854648",
            "length": 4112.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-a1adac9a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "204250153388322770848330902332628700526",
            "length": 3356.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "sec1_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-a66427a0",
        "signature_version": "v1",
        "digest": {
            "function_hash": "220321280194033903242401789514571857069",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security2.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-a6afb3c1",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "13697352475489562871465773862785742637",
                "273746855842934768488927238453882862702",
                "39237291785320425519940417583372049919",
                "278248884436414595766497304803495653292",
                "141494834724323226474815268400120414915",
                "115592113862586847264517258495527512850",
                "60642355015105531142184602057485525562",
                "233838646533457620023491698430261770172",
                "54171944180825270306620377220468869211",
                "131393921808815503442197909735008397591",
                "199997960049333816980116702779195050204",
                "11008475821056786179527368070442488398",
                "42062047691632535235721011924170989522",
                "191197144476338073590583860248495215046",
                "49203325046158456318644597283730862842",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "178912916035348202198452320151291494346",
                "56138674746168054615722463919633841385"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-adba30ba",
        "signature_version": "v1",
        "digest": {
            "function_hash": "223536219045440876253511494779194151885",
            "length": 5369.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/mbedtls/port/include/mbedtls/esp_config.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-b295d2a6",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "258789193336565553558129560693305994792",
                "314986403183807104215610778254465082389",
                "331914707333590245266331099214247816856",
                "197082307710005892702113781229223067870",
                "115882509426882063156798737857418244590",
                "48783316460964868554487013613599792969"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "sec2_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-b3499ead",
        "signature_version": "v1",
        "digest": {
            "function_hash": "161685405431829692005481439455685208075",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "sec1_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-b6770011",
        "signature_version": "v1",
        "digest": {
            "function_hash": "220321280194033903242401789514571857069",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "sec1_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-bc86de2c",
        "signature_version": "v1",
        "digest": {
            "function_hash": "220321280194033903242401789514571857069",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/mbedtls/port/include/mbedtls/esp_config.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-c1559679",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "321189073728696965463177569112053558497",
                "157489157259703187143966290248815678464",
                "230331169111475247975252542541404274340",
                "291198250202741885478163117188791494548"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/mbedtls/port/include/mbedtls/esp_config.h"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-c7494659",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "258789193336565553558129560693305994792",
                "314986403183807104215610778254465082389",
                "331914707333590245266331099214247816856",
                "197082307710005892702113781229223067870",
                "115882509426882063156798737857418244590",
                "48783316460964868554487013613599792969"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "sec2_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-cbe81c59",
        "signature_version": "v1",
        "digest": {
            "function_hash": "161685405431829692005481439455685208075",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security1.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-d51b2578",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "122921837595916614429287090918435470191",
                "158307852764559595536495513358596307718",
                "227719143938806643552088228333031112127",
                "254461542196862791975914989128261930819",
                "135516208060193955924103971132656288599",
                "17303036144169493564467096199268722713",
                "73147217691436512037823382139202767421",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "112672983547878983325999939125066159515",
                "269424886357760685924907219156106003826"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/0ea58d79845ad674d0358d5de246015a68c4cb4f",
        "id": "CVE-2026-45542-d7ea7136",
        "signature_version": "v1",
        "digest": {
            "function_hash": "71005990062231931980358509090582854648",
            "length": 4112.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-e32c80a8",
        "signature_version": "v1",
        "digest": {
            "function_hash": "137143555355116739810665479923994377905",
            "length": 4237.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "sec1_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/71eb2dbe6aaef830719ecac8edf409e2992b64b2",
        "id": "CVE-2026-45542-e864a31e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "220321280194033903242401789514571857069",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command1"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-e931c10e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "183766873230718209336473706934289265519",
            "length": 3481.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-eae90b84",
        "signature_version": "v1",
        "digest": {
            "function_hash": "71005990062231931980358509090582854648",
            "length": 4112.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security1.c",
            "function": "sec1_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-ec8aaff0",
        "signature_version": "v1",
        "digest": {
            "function_hash": "220321280194033903242401789514571857069",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "sec2_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/f5d24a7e919bc5f447091479656b86da6762a103",
        "id": "CVE-2026-45542-f3e46261",
        "signature_version": "v1",
        "digest": {
            "function_hash": "161685405431829692005481439455685208075",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "sec2_req_handler"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/a2f4554f10ba075c98cbc67464db096ba32497cf",
        "id": "CVE-2026-45542-fd721c36",
        "signature_version": "v1",
        "digest": {
            "function_hash": "161685405431829692005481439455685208075",
            "length": 1322.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "components/protocomm/src/security/security2.c",
            "function": "handle_session_command0"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/56c3e385611e63162d0f2f8504ac4ae2ccfccef0",
        "id": "CVE-2026-45542-fe0b950c",
        "signature_version": "v1",
        "digest": {
            "function_hash": "71005990062231931980358509090582854648",
            "length": 4112.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "components/protocomm/src/security/security1.c"
        },
        "deprecated": false,
        "source": "https://github.com/espressif/esp-idf/commit/9b4cacf9cbc69379972de6a2247fcf5af9240961",
        "id": "CVE-2026-45542-fea48b56",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38599976760887309718564177547076639349",
                "122921837595916614429287090918435470191",
                "158307852764559595536495513358596307718",
                "227719143938806643552088228333031112127",
                "254461542196862791975914989128261930819",
                "135516208060193955924103971132656288599",
                "17303036144169493564467096199268722713",
                "73147217691436512037823382139202767421",
                "286346987763872458534344320349256393375",
                "129558991831843771427033777233893830326",
                "112672983547878983325999939125066159515",
                "269424886357760685924907219156106003826"
            ],
            "threshold": 0.9
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45542.json"