# SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
# SPDX-License-Identifier: Apache-2.0
#
# Repository-local CVE exclusions for this ESP-IDF revision.
#
# esp-idf-sbom merges this file into its global exclusion list when scanning
# this tree (see the "Excluding CVEs" section of the esp-idf-sbom README). It
# uses the same format as esp-idf-sbom's own excluded_cves.yaml. Because the
# file lives in the tree it is scoped to this branch/revision: the affected
# release tags predate it and are still reported, while release/v5.2 -- which
# carries the fixes -- is not.
#
# CVE-2026-45160 is pinned by NVD to 5.2.7 on the 5.2 line and patched in
# 5.2.8; the fix is already merged on release/v5.2. Once version.cmake is
# bumped to 5.2.8, NVD no longer matches and the entry becomes a no-op that
# can be removed.
#
# CVE-2025-55297 is a stale NVD record: it is fixed since v5.2.6, but NVD's
# affected range for the 5.2 line ([5.2, 5.3.3)) was assigned before v5.2.6
# was released and never narrowed, so it matches any version this branch will
# ever report. The entry stays until the NVD record is corrected. The same
# exclusion exists in esp-idf-sbom's global excluded_cves.yaml to also cover
# scans of the released v5.2.6/v5.2.7 tags, which predate this file; it is
# kept here as well so the information lives next to the sources (on duplicate
# CVE IDs the repository-local entry wins).

CVE-2026-45160:
  cpes:
    - cpe: cpe:2.3:a:espressif:esp-idf:5.2.7:*:*:*:*:*:*:*
  reason: >-
    Out-of-bounds read in the DHCP server option parser
    (components/lwip/apps/dhcpserver/dhcpserver.c). Fixed on release/v5.2,
    patched in 5.2.8 (commit 2da2db43fd7e). The branch still reports 5.2.7
    until 5.2.8 is released.

CVE-2025-55297:
  cpes:
    - cpe: cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*
      versionStartIncluding: '5.2.6'
      versionEndExcluding: '5.3'
  reason: >-
    Memory overflows in the BluFi example, fixed on the 5.2 release line since
    v5.2.6 (commits bf50c0c197af and e65cf7ea2a2b). NVD's affected range for
    the 5.2 line ([5.2, 5.3.3)) was assigned before v5.2.6 was released and
    never narrowed, so it still matches the fixed releases and this branch.
    https://github.com/espressif/esp-idf/security/advisories/GHSA-9w88-r2vm-qfc4