esp-idf-sbom reports five ESP-IDF CVEs against this branch because NVD
pins them to 5.5.4 -- the version release/v5.5 still reports until 5.5.5
is released -- even though the fixes are already merged here:
- CVE-2026-45160 DHCP server OOB read (d51b107609)
- CVE-2026-45328 ESP-TEE hardening against REE manipulation (b471faf803)
- CVE-2026-45329 ESP-TEE service-call input validation (eebabaff2f, dcb758a30b)
- CVE-2026-45541 esp_http_server WebSocket NULL dereference (00a2f7fbbb)
- CVE-2026-45542 protocomm SRP6a heap overflow (71eb2dbe6a)
esp-idf-sbom merges this repository-local excluded_cves.yaml into its
exclusion list when scanning the tree, so these CVEs are reported as
excluded for this branch while the released v5.5.4 tag, which predates
this file, is still reported. Once version.cmake is bumped to 5.5.5 the
entries become no-ops (NVD does not list 5.5.5) and can be removed.
Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
