Open-source firmware report

ESPHome

Firmware framework for ESP32 and other microcontrollers in home automation.

github.com/esphome/esphome · 99 components read from oss-esphome__esphome.cdx.json (analysed 2026-10-11) · checked against today's advisories 2026-10-11

Vulnerabilities affecting this build

13reported by a scanner that checks NVD
30reported by Firmpath
17only in vendors' own advisories, or not yet in NVD for this version
4to upgrade
5to look at
4clear
86no advisory source

To upgrade

A published vulnerability affects the version this build uses.

mbedtls 3.6.6 Upgrade to 3.6.7 or later14 vulnerabilities · an NVD scanner reports 1
nimble 1.6.0 Upgrade to 1.10.0 or later12 vulnerabilities · an NVD scanner reports 12
  • CVE-2026-45815 nimble high
    Remote reachable assertion in ATT Read Multiple Variable Response handler
    nvd.nist.gov · cve.org
  • CVE-2025-52435 nimble high
    Invalid error handling in pause encryption procedure in NimBLE controller
    nvd.nist.gov · cve.org
  • CVE-2024-51569 nimble high
    Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
    nvd.nist.gov · cve.org
  • CVE-2026-45813 nimble high
    Incorrect data validation in BASS add/modify source operation
    nvd.nist.gov · cve.org
  • CVE-2024-24746 nimble high
    Denial of service in NimBLE Bluetooth stack
    nvd.nist.gov · cve.org
  • CVE-2026-45811 nimble high
    Buffer overflow in socket HCI transport
    nvd.nist.gov · cve.org
  • CVE-2025-53477 nimble high
    NULL Pointer Dereference in NimBLE host HCI layer
    nvd.nist.gov · cve.org
  • CVE-2026-45816 nimble high
    NULL pointer dereference vulnerability in SMP LTK request
    nvd.nist.gov · cve.org
  • CVE-2026-45812 nimble medium
    OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
    nvd.nist.gov · cve.org
  • CVE-2024-47249 nimble medium
    Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler
    nvd.nist.gov · cve.org
  • CVE-2026-46452 nimble medium
    Mesh Proxy SAR reassembly unbounded append and unchecked failure
    nvd.nist.gov · cve.org
  • CVE-2025-53470 nimble low
    Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
    nvd.nist.gov · cve.org
esp-idf 5.5.5 Upgrade to 6.1.1 or later2 vulnerabilities · an NVD scanner reports 0
  • CVE-2026-81508 espressif missed by NVD scannersmedium
    Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
    github.com · cve.org
  • CVE-2020-26142 espressif missed by NVD scannersmedium
    Vulnerable Espressif WLAN device processes every single fragmented AMPDU frame as an independent and a full frame
    espressif.com · cve.org
espasyncwebserver 3.9.6 Upgrade to 3.11.2 or later2 vulnerabilities · an NVD scanner reports 0
  • CVE-2026-54571 espasyncwebserver missed by NVD scannershigh
    Integer overflow in multipart boundary parser causes denial of service
    github.com · cve.org
  • CVE-2026-62966 espasyncwebserver missed by NVD scannershigh
    Null-pointer write in ESPAsyncWebServer multipart parser
    github.com · cve.org

To look at

Version numbers cannot settle these: usually a vendor's fork that may already carry the fix.

lwip 2.2.0 A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 1
  • CVE-2020-22283 silabs high
    Buffer overflow vulnerability via a crafted ICMPv6 message may lead to accessing sensitive information
    nvd.nist.gov · cve.org
openthread 2026.07.0.. A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 0
  • CVE-2023-2626 openthread missed by NVD scannershigh
    Missing Key ID Mode validation when processing 6LoWPAN frames
    github.com · cve.org
freertos-kernel version not stated Bundled in an SDK with no version of its own. Check the advisories.5 vulnerabilities · an NVD scanner reports 5
  • CVE-2026-77235 freertos high
    Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel
    github.com · cve.org
  • CVE-2026-77236 freertos high
    Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel
    github.com · cve.org
  • CVE-2026-77234 freertos high
    Improper input validation in FreeRTOS-Kernel timer command handling
    github.com · cve.org
  • CVE-2024-28115 freertos high
    Potential Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled
    github.com · cve.org
  • CVE-2026-77237 freertos medium
    Missing type validation in xQueueAddToSet in FreeRTOS-Kernel
    github.com · cve.org
arduinocore-api version not stated Bundled in an SDK with no version of its own. Check the advisories.1 vulnerability · an NVD scanner reports 0
coex-lib version not stated Bundled in an SDK with no version of its own. Check the advisories.1 vulnerability · an NVD scanner reports 0
  • CVE-2021-26706 silabs missed by NVD scannersmedium
    Update to “BadAlloc” Security Vulnerability in Micrium OS Dynamic Memory Pool Allocations
    raw.githubusercontent.com · cve.org

No advisory source

No vendor advisory, NVD or OSV record has ever named these. That is not the same as safe: nobody is publishing about them.

How this was made, and what it is not

We read the project's build description (manifests, submodules, the SDK it pins), took each SDK release apart into the libraries it bundles, and compared every version with the ranges in vendors' own advisories, NVD and OSV. Every verdict is computed from versions; each finding links to the document it came from. Missed by NVD scanners means a scanner keyed on NVD's CPE records would not report it for this version: no CVE, no NVD record, or NVD files it under another product. The comparison counts only vulnerabilities affecting the version this build uses.

It describes the repository's default build, not any particular binary, and a project may configure out the affected code. It is not an audit. It is recomputed daily as advisories are published. Also as JSON.