ESP32_Serial_Swiss_Army_Knife/docs/dependency_advisory_coverage.md

Broader dependency advisory coverage

Review date: 2026-09-16. Documentation-only, finite snapshot; not security certification, upgrade approval, or Phase 9 sign-off.

Result and authority

New actionable maintenance finding: the installed IDF 5.5 Wi-Fi bundle predates the official 5.5.3 correction for management-frame memory corruption. The project's PMF-capable WPA2/WPA3 SoftAP supplies the relevant supported configuration. Prioritize a coherent vendor-bundle update/backport investigation; see the exact evidence and limitations below. This is a current-feature exposure candidate supported by the vendor's release/fix description, not a demonstrated device exploit or independently audited binary implementation.

No additional current-path security correction was established for esp_tinyusb, TinyUSB, mDNS, LED strip, or the two vendored browser packages in this finite search. That statement does not establish that these dependencies are vulnerability-free.

• IDF security review remains authoritative for its detailed mbedTLS findings, DHCP-server/EMS/X.509 backports, WebSocket subprotocol exclusion, and first-page feature dispositions. This document completes the previously omitted IDF advisory-index pages, without repeating those audits or claiming a fresh override verification.
• Wolf security review, key-validation review, and remaining parser review retain their scopes and outstanding gates. Wolf advisories were not re-searched here.
• Only docs/dependency_advisory_coverage.md was created. No sources, pins, manifests, assets, generated outputs, configuration, builds, tests, or devices were changed/run. Existing build metadata was read, not regenerated; it does not establish executable freshness or device state.

Baseline actually inspected

Managed manifests were read from installed component directories, not inferred from the application's semver constraints. The application requests mdns: ^1.8.2, but installed mDNS is 1.12.0.

Dependency	Installed/source identity	Current use
ESP-IDF	Existing reviewed 5.5.0 baseline; additional original SDK sources and Wi-Fi archives inspected below	Wi-Fi AP/STA, lwIP, HTTPS; existing local security overrides remain part of effective inputs
espressif/esp_tinyusb	2.2.1, manifest commit 8e779566ef71d43928cbf7e125e8eb54bab3f542, path device/esp_tinyusb	CDC device wrapper
espressif/tinyusb	0.21.0~1, manifest commit 7049c58a0e895acc92c6407574b05b5536eddfc8	Espressif fork, not interchangeable with an unqualified upstream 0.21.0 claim
espressif/mdns	1.12.0, manifest commit db06b19b7be729c163d346f62ec0eba01047b7f1	STA hostname responder; no registered DNS-SD services or browser/query application calls
espressif/led_strip	3.0.3, manifest commit 7cd447361ca2f0a1c01aa3089e3031f6171b6c7e	One WS2812, RMT, no DMA
@xterm/xterm	5.5.0 per asset provenance; local JS SHA-256 1f991ac3b4b283ebf96e60ae23a00a52765dd3a2e46fa6fdda9f1aab032f7495 rechecked	Serial and admin browser terminals
@xterm/addon-fit	0.10.0; local JS SHA-256 bdaefa370b1bfc42ee88d46fe6072400902a4d4b2d45cd93438dda9b23c97089 rechecked	Only loaded addon

Browser version attribution is to the recorded exact-package provenance plus matching local hashes. No npm install, registry dependency resolution, asset download, decompression, or embedded-asset regeneration was performed. Generated compressed arrays were not independently re-hashed in this slice.

Local configuration evidence is .pio/build/esp32-s3-devkitc-1-n16r8/config/sdkconfig.h; compilation evidence is a filtered read of the existing compilation database. Source references under components/ below are relative to /home/mscholz/.platformio/packages/framework-espidf/.

Finite search ledger: URLs checked and stopping rules

The search ended at the following dated snapshot. Empty official repository advisories mean no published advisories returned by that endpoint, not no CVEs anywhere, no undisclosed defects, or a security guarantee. GitHub releases and component changelogs are different publication channels; an empty Releases list is not evidence that component versions stopped shipping.

IDF advisory index: all snapshot pages

Fetched the official HTML index page 1, page 2, and page 3: 10 + 10 + 2 = 22 entries, oldest June 23, 2022, newest September 3, 2026. Page 3 is the terminal listed page. Full advisory descriptions were read from the official repository advisory API, not merely titles.

The API page=2 request unexpectedly returned the same 22 entries with no Link header. It was not treated as an empty-page proof or 22 additional advisories. The HTML pagination and unique IDs establish the 22-entry snapshot boundary. No unbounded pagination or general web search followed.

Other official advisory channels

Each URL below returned the stated number of public advisory records, with no next-page Link header:

Official endpoint checked	Records	Disposition
esp-usb	3	HID/UVC host issues; device CDC exclusion below
hathach/tinyusb	0	No published records returned
espressif/tinyusb	0	Fork checked separately
esp-protocols	0	mDNS release fixes screened separately
idf-extra-components	0	LED changelog screened separately
xterm.js	0	Browser release fixes screened separately

Release/changelog boundary

• IDF: release API page 1 returned 100 records; page 2 returned 64 and no additional 5.5 tags. Screened published stable 5.5.1–5.5.5 GitHub release bodies for explicit security, vulnerability, overflow, out-of-bounds, corruption, UAF and double-free descriptions; followed the relevant additional candidates below. This is not a line-by-line audit of every bugfix or another IDF branch. 5.5.4 body mainly describes a NimBLE regression. The linked full 5.5.4 and 5.5.5 release databases returned no textual content through the fetch tool: their database-only contents are an explicit coverage gap, not reviewed pages.
• esp-usb: Releases API returned zero. Read the official component changelog through 2.3.0, and current manifest, also 2.3.0. This establishes a changelog ceiling, not proof of registry publication or compatibility.
• TinyUSB: upstream Releases API returned 18 records, newest 0.21.0, whose full release notes were read. Fork Releases API returned zero. Installed fork commit API identifies the merge “Necessary fixes for TinyUSB 0.21.” No later published upstream release was present. Two legacy-path requests, upstream and fork, returned 404; docs listing then changelog directory resolved the moved layout and confirmed 0.21.0 as its highest listed version. Unreleased commits/PRs were not exhaustively searched.
• mDNS: esp-protocols release page 1 returned 100 records and page 2 37. Post-pin mDNS releases in that finite list are 1.13.0 (September 14) and 1.13.1 (September 15). Their notes and both production-source fix patches were inspected; other monorepo components are outside this slice.
• LED: Releases API returned zero. Official LED changelog ends at 3.0.3, matching installed version.
• xterm: Releases API returned 89 records with no pagination. Read 5.5.0 baseline and 6.0.0 (December 22, 2025) post-pin release notes. 5.5.0 explicitly lists addon-fit 0.10.0 as compatible. Screened 6.0.0's security-relevant addon fixes and actual integration below; did not mistake npm development/demo dependency updates for packages served by this firmware.

This completes the declared finite search, not every possible vendor/CVE channel. NVD, OSV, npm's global advisory database, private advisories, all historical SDK subdependency advisories, every unreleased commit, and all non-security-labelled release regressions were not exhaustively searched. The failed full-release-database fetches remain visible above.

IDF pages 2–3: all twelve previously omitted entries

All linked advisory bodies below were included in the fetched official API response. “Not-current-path” does not mean the underlying library is patched.

Advisory / CVE	Required feature and snapshot disposition
GHSA-9j5x-rf36-54x9, CVE-2026-25508	BLE provisioning ATT prepared-write length accumulation. Not-current-path: Bluetooth/provisioning absent.
GHSA-m2h2-683f-9mw7, CVE-2026-25532	WPS enrollee fragment underflow requires initiating WPS PBC/PIN pairing. Not-current-path: no application esp_wifi_wps_* calls; no enabled WPS setting in the inspected generated header. Ordinary PSK/SAE association is not WPS.
GHSA-hmjj-rjvv-w8pq, CVE-2025-68473	Bluedroid Classic SDP UUID-array overflow. Not-current-path: Bluetooth absent.
GHSA-43gh-7r4f-qp57, CVE-2025-68474	Bluedroid Classic AVRCP vendor-command allocation/write. Not-current-path: Bluetooth absent.
GHSA-vcw6-jc3p-4gj8, CVE-2025-65092	ESP32-P4 hardware JPEG header parser. Not-current-path: ESP32-S3, no JPEG driver compilation inputs.
GHSA-qhf9-vr2h-jh96, CVE-2025-66409	Bluedroid Classic AVRCP vendor-command read. Not-current-path: Bluetooth absent.
GHSA-8mg7-9qpg-p92v, CVE-2025-64342	Original ESP32 Bluetooth controller invalid access address. Not-current-path: S3 explicitly outside affected chip family; Bluetooth also absent.
GHSA-9w88-r2vm-qfc4, CVE-2025-55297	BluFi example credential/DH buffers. Not-current-path: no BluFi integration, no Bluetooth host. Not a generic flaw in this project's Wi-Fi password handling.
GHSA-hqhh-cp47-fv5g, CVE-2025-52471	ESP-NOW receive underflow. Not-current-path: no application ESP-NOW initialization or receive callback. Does not prove opaque Wi-Fi archives are globally fixed.
GHSA-wm57-466g-mhrr, CVE-2024-53845	ESPTouch v2 constant AES-CBC IV. Not-current-path: no SmartConfig/ESPTouch provisioning calls; PSK/SAE manager is separate.
GHSA-22x6-3756-pfp8, CVE-2024-28183	Physical flash TOCTOU against anti-rollback. Excluded/not configured: no enabled CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK; physical firmware replacement is outside current review model. No claim of secure boot or rollback protection.
GHSA-7f7f-jj2q-28wm, CVE-2022-24893	BLE Mesh provisioning SegN bounds. Not-current-path: Bluetooth/Mesh absent.

Rechecked local evidence: target esp32s3/Xtensa; no enabled CONFIG_BT_ENABLED; compilation-entry counts /bt/host/, esp_driver_jpeg, /esp_tee/ each zero. Targeted application searches for WPS, ESP-NOW, SmartConfig, BluFi and protocomm found no integration. These exclusions do not depend on later release tables implicitly excluding 5.5.0. Revisit before enabling these features.

Together with the ten entries already dispositioned in the IDF review, this accounts for all 22 unique IDs in the dated official index.

New release-note finding: Wi-Fi management-frame corruption

Priority: prompt coherent vendor correction review for PMF-capable SoftAP operation. Not fixed by existing DHCP/mbedTLS overrides. Reported to the parent during this review.

Official IDF 5.5.3 release says “Fixed memory corruption issue by ensuring management frames are only encrypted when they are robust management frames,” referencing a3927641. Fetched patch and commit API: merge commit a3927641bfd0aedfaab3514cba3d7fb01378ce4d, contained patch commit caf4cad3b422be5c2f93afeff4cd07796a262b46. The different patch-header ID is the contained commit, not an invented match to the merge hash.

The patch description states that when the supplicant sends an authentication response for an already-connected station with installed keys, unconditional management-packet encryption based on bss->pmf_enable assumed extra encryption-header space that was not present. It also mentions incorrect allocation due to RSN IE length mismatch; that second trigger was not independently established for the project's short configured IE set.

Current application prerequisites and original interface

src/wifi_manager.c:315–331, configure_ap():

wifi_config.ap.authmode = WIFI_AUTH_WPA2_WPA3_PSK;
wifi_config.ap.max_connection = 4U;
wifi_config.ap.pmf_cfg.capable = true;
wifi_config.ap.pmf_cfg.required = false;
wifi_config.ap.sae_pwe_h2e = WPA3_SAE_PWE_BOTH;
esp_err_t error = esp_wifi_set_config(WIFI_IF_AP, &wifi_config);

required=false does not disable negotiated PMF. AP/APSTA is a supported runtime policy (wifi_manager.c:382,646), not an unused SDK feature; generated CONFIG_ESP_WIFI_SOFTAP_SUPPORT=1 and WPA3 SAE support are enabled. Exposure is conditional on AP operation and the vendor-described station/key/PMF state. No claim is made that an arbitrary unassociated peer can exploit it.

Original configured compilation input components/wpa_supplicant/esp_supplicant/src/esp_wpa_main.c:146–155 still contains:

uint8_t *wpa_ap_get_wpa_ie(uint8_t *ie_len)
{
    /* ... existing hostapd checks ... */
    *ie_len = hapd->wpa_auth->wpa_ie_len;
    return hapd->wpa_auth->wpa_ie;
}

esp_wifi_driver.h:133 has the matching uint8_t *len callback signature; esp_wpa_main.c:489–496 registers it under CONFIG_ESP_WIFI_SOFTAP_SUPPORT. This is an interface/provenance marker for the old bundle, not the source location of the opaque management-encryption defect.

Exact binary-bundle provenance

The official fix changes both callback signatures to size_t * and replaces components/esp_wifi/lib with a4e903fe43bf09a95022f9802db43d39740ccc0b. A C-only signature edit is not an adequate or ABI-safe implementation of this correction.

A local git rev-parse in the packaged Wi-Fi submodule failed because its Git metadata is not usable. Instead, calculated Git blob SHA-1 values directly from all seven installed esp32s3/*.a files and compared them with official content metadata:

• IDF v5.5 submodule pointer: 8a1b7bbc00e895d040c5c9a6fb9d1db2bbfc7958.
• Baseline ESP32-S3 archive listing: all seven local blob IDs match (core, espnow, mesh, net80211, pp, smartconfig, wapi).
• Corrected bundle listing: all seven differ from installed.
• Installed libnet80211.a: Git blob 6ee20bec142638dc0a442b9642de9fa62db6ddd0, SHA-256 dcb524dda8563976cf1a97d4398c7b06cf024b7ef9a5f07788e84c88792d8071; corrected bundle's Git blob is 8ce8a2a6a9a753e31508bd609bf0a0d1d44c332f.

This confirms the installed stock-baseline bundle, not a hidden same-version binary replacement carrying the published fix. It does not independently reverse-engineer the affected routine or establish a reliable remote attack.

Parent action: investigate a maintained IDF/vendor bundle carrying the complete correction, with matching supplicant ABI and all existing source-pinned overrides rebased and revalidated. Do not replace one archive or change only the callback type. Preserve USB/UART0 recovery and broker isolation. Target regression should cover PMF-capable WPA2/WPA3 SoftAP association, repeated authentication/reassociation with keys already installed, APSTA transitions and loaded service recovery. These tests were not performed. No blind recommendation to weaken PMF or disable recovery AP policy is made.

Additional IDF release candidates screened

These are supplemental to, not replacements for, the existing detailed IDF review.

Release candidate / fetched evidence	Actual-use disposition
5.5.1 DHCP client option/HW-ID length, bcd56c74 patch, contained commit 1ad41e589ff7296c484ba64f206f2278a09dab37	Original lwip_default_hooks.c:262–269,293–300 retains old checks; generated option length 68, vendor class ID disabled. Client path is used, but current hostname is fixed CONFIG_LWIP_LOCAL_HOSTNAME="espressif" and no application esp_netif_set_hostname() call exists. Inspected dhcp_select()/dhcp_discover() build bounded fixed options, short hostname and six-byte MAC, leaving space in 68 bytes; no current long-option trigger established. mDNS suffix is not the DHCP hostname. Revisit/backport before longer hostnames or extra options. Distinct from already fixed DHCP server CVE-2026-45160.
5.5.2 esp_timer_dump() overflow, a511f3be patch, contained commit ec71bd189f6ef42aff2daa99f35d98611bb9faa3	Original esp_timer.c:613,616 retains old line-size constants 90/46 (fix 103/47) and profiling branch's incorrect size addition. No application dump call; timer profiling absent. Not-current application path, not a globally patched timer library or a ban on ordinary timers.
5.5.3 HTTP client Digest OOB read, 6d0a7a01 patch, contained commit bbcc13be8b38283547883bfee4920331bea80cd1	Original esp_http_client/lib/http_auth.c:131–132 uses fixed-length memcmp on server algorithm string; no application HTTP-client/Digest consumer. Not-current-path; the HTTPS server's cookie login is not this function.
5.5.3 AES DMA/PSRAM cache ordering, 3f10cdab patch, contained commits 525ef3a2eab239e30cd4cc62f6d23b61743fe4c1, 0742f3fce3a1779c63ec286342f6d9799e12822f	Original esp_aes_dma_core.c:1121–1128 invalidates after DMA; file is a configured compilation input. S3 has SOC_PSRAM_DMA_CAPABLE=1, so target name alone does not exclude it. Generated CONFIG_MBEDTLS_HARDWARE_AES absent; esp_config.h:150–153 therefore undefines MBEDTLS_AES_ALT, and no application esp_aes_* call was found. No current application mbedTLS hardware-AES path established. Direct SDK/opaque-radio consumers and their destination buffers were not exhaustively traced: retain this as a residual SDK applicability question, not global exclusion or a verified current HTTPS corruption finding.
Bluetooth, provisioning, JPEG, TREL/OpenThread, other-chip secure-boot/flash-encryption release fixes	Bluetooth/JPEG/provisioning exclusions above apply; project is not an OpenThread/TREL application. Physical security and other-chip configuration changes do not establish an S3 network attack. These release categories were screened, not their entire implementations audited.

Managed USB applicability

Published esp-usb records are GHSA-gp8r-qjfr-gqfv (HID host close double-free race), GHSA-2pm2-62mr-c9x7 (HID host descriptor UAF), and GHSA-g65h-9ggq-9827 (UVC host descriptor-printing stack overflow). Official affected components are usb_host_hid through 1.0.4 and usb_host_uvc through 2.3.1, not similarly numbered esp_tinyusb releases.

src/usb_cdc_transport.c:763–781 calls TINYUSB_DEFAULT_CONFIG(device_event_callback), tinyusb_driver_install(&usb_config), and tinyusb_cdcacm_init(&cdc_config) for TINYUSB_CDC_ACM_0, using the S3 internal full-speed PHY. Generated settings enable one CDC, 1,024-byte RX/TX buffers, 512-byte CDC endpoint buffer, no HID/MIDI/vendor instances, no DFU/network class. esp_tinyusb/include/tusb_config.h:88 enables device mode and maps class counts at lines 192–201. Filtered compilation database contains zero HID-host, UVC-host, or TinyUSB src/host entries. Thus all three published host advisories are not-current-path, without relying on “USB requires physical access” as an exclusion.

Post-pin wrapper changelog 2.3.0 describes MTP, IDF6 MSC compatibility and power-management/light-sleep integration, not a newly identified CDC memory-safety fix. MSC/MTP is not used; CONFIG_PM_ENABLE absent. Upstream TinyUSB's newest published 0.21.0 notes include EP0 OUT copy clamping, HID descriptor bounds and MSC callback-size caps. These are baseline-release fixes rather than evidence that a later release must be backported. Spot-check: installed src/device/usbd.c:881,920 limits data_len to wLength and clamps transferred bytes to remaining control data. SHA-256 38de54351d81878e6543f2b022d0c39f45d28c8f0888491796398dec45e727be. This is not a complete USB control-request audit or proof every upstream fix is in the fork.

mDNS post-pin fixes

mDNS is network-reachable when STA discovery starts: src/wifi_manager.c:117 calls the application service, whose src/mdns_service.c:154–160 calls mdns_init(), mdns_hostname_set() and mdns_instance_name_set(). It is not globally disabled. The generated profile enables only predefined STA, maximum one interface/service, and has no CONFIG_MDNS_ENABLE_BROWSE. No application mdns_service_add*, mdns_query_* or mdns_browse_* calls were found.

1. 1.13.0 duplicate DNS-SD question expansion: fetched c56c725dd5e77c83c1a0683fce6dd3521e05cea2. Upstream test explicitly calls repeated _services._dns-sd._udp.local PTR questions “heap amplification”: each expands the registered service list. Installed mdns_receive.c:711–716 lacks the new if (parsed_packet->discovery) continue; guard and allocates inside while (a) after a = mdns_priv_get_services(). Primitive unpatched, no current amplification trigger: no services registered; mdns_responder.c:38–45 zeroes the server and :102–104 returns its initially empty service list. A hostname/instance label is not a service registration, and MAX_SERVICES=1 is a capacity, not one active service. Reassess before advertising _https, _ssh, or any DNS-SD service; the guard is a sensible narrow defense-in-depth candidate, not a demonstrated current responder DoS fix.
2. 1.13.1 staged-IP NUL termination: fetched b370a9abc29390b4adc612d251cc2dbbb325ff6f. Adds new_staged_ip->hostname[MDNS_NAME_BUF_LEN - 1] = '\0';; commit describes a GCC truncation warning. The installed receiver does not contain rx_staged_ip_add(); browsing is also disabled. Do not assert an installed unterminated-buffer vulnerability simply from version ordering or the release-note title. No current-path defect established.

Installed receiver SHA-256: 9ada93eb2f89080a28bf2a849871e054032f06889c40397555de527af0e3d7bd. Earlier mDNS release notes mention parser/browse hardening, but this slice did not re-audit every pre-pin fix or equate the absence of a GHSA with a safe parser.

LED strip and offline browser assets

LED: src/status_led.c:15–36 fixes max_leds=1, WS2812/GRB, RMT, with_dma=false; :72–77 sets pixel index zero then refreshes. No peer-controlled strip allocation or index is supplied. No later release/security correction was identified in the declared official channels; no blanket driver safety claim.

Browser integration: src/web_ui.c:1507–1519 creates a terminal with allowProposedApi:false, loads only FitAddon, and :1552–1554 does the same for admin. :1531 feeds received bytes to target.write(new Uint8Array(data), ...). Serial-device output is not automatically trustworthy just because a browser session authenticated; escape-sequence rendering remains a real boundary.

Post-pin 6.0.0 candidate dispositions:

• PR5020 patch, “Escape Unsafe HTML Characters in addon-serialize,” changes addon-serialize HTML output, not the core terminal renderer. That addon and serializeAsHTML() integration are absent. Not-current-path, not an assertion that all xterm 5.5 HTML rendering was repaired.
• PR5355 patch, “Add note about reverse tabnapping,” is documentation-only in addon-web-links typings, warning about iframe/custom-handler behavior. The addon is not loaded. Do not report this as a core security fix missing from 5.5.0.
• Core OSC 8 links exist even without addon-web-links. Checked 5.5.0 upstream provider and targeted matching snippets in hash-verified local JS: absent allowNonHttpProtocols, protocols are limited to http:/https:; default activation confirms navigation and sets newWindow.opener=null before assigning location. Application supplies no custom linkHandler. This rebuts an automatic arbitrary-protocol/tabnapping finding from these release notes, not all phishing/social-engineering risks or browser implementation issues.
• Other release-note changes include OSC parsing/correctness, readonly behavior for disabled input, selection/renderer fixes, and new clipboard/progress functionality. Only fit is installed; search, image, serialize, web-links, ligatures, clipboard and WebGL addons are not supplied. Build/demo updates to Express, ws, webpack, axios, etc. are not automatically firmware/browser runtime dependencies. No additional current security trigger was established from that release-note screen.

A future xterm upgrade would need deliberate addon compatibility, offline asset provenance/regeneration and browser regression review; no asset or version change is authorized by this document.

Validation and handoff limits

Performed: official bounded advisory/release fetches; all 22 IDF index-entry accounting; targeted source/config/caller and configured-input inspection; managed manifest checks; two local web-asset hash checks; seven Wi-Fi archive Git-blob comparisons; source snippet/hash capture. Final checks passed for document whitespace/final newline, six local links, dated scope, and twelve additional IDF plus three USB advisory IDs. Document-scoped git diff --check also passed (the new untracked file was explicitly checked by Python). Final Git status showed concurrent changes in release-notice/validation/icon-provenance files outside this ownership scope; none were edited or reverted here. No firmware build, host regression execution, browser test, USB transaction, radio packet test, fault injection, upload, monitor, erase, or target resource measurement was performed.

Parent summary: carry forward the Wi-Fi bundle correction investigation and the residual direct-SDK AES-DMA applicability question. Do not describe either as implemented, or the AES question as an established current-path vulnerability. Preserve prior detailed wolf/IDF review authority and all existing mitigations. The omitted official IDF index pages and named managed/browser publication channels now have a finite dated coverage record; full release-database contents, unpublished issues, opaque implementation analysis and hardware acceptance remain outside the completed evidence. Re-run a bounded publication check before release or when dependencies, enabled features, callers, or trust boundaries change.