This vulnerability is a NULL‑pointer dereference in the WebSocket subprotocol‑negotiation path of the ESP‑IDF esp_http_server component. During the WebSocket handshake, the server parses the client‑supplied Sec-WebSocket-Protocol request header. If the header value is malformed, the tokenisation result is dereferenced without a NULL check, causing the server to crash before any application‑level authentication runs. The flaw is categorized as CWE‑476. The primary impact is a crash that can lead to a denial of service. The vulnerability does not provide direct remote code execution or data exfiltration but can be used to disrupt services.

Espressif IoT Development Framework (ESP‑IDF) versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0 are affected. These releases include the escaped Sec-WebSocket-Protocol flaw in the HTTP server component. The issue was patched in subsequent releases – 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1 – which add a NULL-check to the tokenisation result.

The vulnerability has a CVSS score of 7.5, indicating high severity. EPSS is not available, so the probability of exploitation in the wild remains unknown. It is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can send a crafted WebSocket handshake containing a malformed Sec-WebSocket-Protocol header to a vulnerable server. This can cause the server to crash before authentication, resulting in a denial of service. Given the high severity score and the remote nature of the exploit, organizations running ESP‑IDF must prioritize remediation.