ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas: Wi-Fi credential handling and Diffie–Hellman key exchange. This vulnerability is fixed in 5.4.1, 5.3.3, 5.1.6, and 5.0.9.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-120",
"CWE-131"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55297.json"
}{
"cpe": "cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "5.0.9"
},
{
"introduced": "5.1"
},
{
"fixed": "5.1.6"
},
{
"introduced": "5.2"
},
{
"fixed": "5.3.3"
},
{
"introduced": "5.4"
},
{
"fixed": "5.4.1"
}
],
"source": [
"CPE_RANGE",
"REFERENCES"
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-55297.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"156718069195225552601309518493754853400",
"4651273288141566203432787391121677576",
"5450208424883404953253788947636113072",
"212250662498059847845573964628673736154",
"140443780821930965946982575988969922783",
"125483958846573307628727124779218251622",
"192589945895917643578248128019074152363",
"23025681073281916378065892596205255988",
"265090150793358509237187042393682248086",
"98850339263440219764764085097559643670",
"28706277393444943867421732117850720742",
"319014018412117820981892491866096122588",
"11535038317845881545672410981899497224",
"132299173107655464416739961996593942283",
"62475831688793100973146978827325373036",
"239959748408126982566592479045931394852",
"312409216813545517587353631923860324521",
"177367434480545604463513578326446377267"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-10cddfa9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "232150552316914472929541799588413471679",
"length": 5516
},
"id": "CVE-2025-55297-157c4f43",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c",
"function": "example_event_callback"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"156718069195225552601309518493754853400",
"4651273288141566203432787391121677576",
"5450208424883404953253788947636113072",
"212250662498059847845573964628673736154",
"140443780821930965946982575988969922783",
"125483958846573307628727124779218251622",
"192589945895917643578248128019074152363",
"23025681073281916378065892596205255988",
"265090150793358509237187042393682248086",
"98850339263440219764764085097559643670",
"28706277393444943867421732117850720742",
"319014018412117820981892491866096122588",
"11535038317845881545672410981899497224",
"132299173107655464416739961996593942283",
"62475831688793100973146978827325373036",
"239959748408126982566592479045931394852",
"312409216813545517587353631923860324521",
"177367434480545604463513578326446377267"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-214ac84b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175734929258255810412998393423740844326",
"length": 2298
},
"id": "CVE-2025-55297-31ceb9f3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c",
"function": "blufi_dh_negotiate_data_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211932293721256966202710578094585543330",
"28187307207019347713287212980142431898",
"56313507085585402283193128946025108122",
"225792548284340363886924199780993309268",
"169639000018978717495728407573969511779",
"299000735249834920223846289490553666550",
"22471409609182823546259449643713415933",
"114025027611314480478009903225236664309",
"115088564007000263176049068429865578728",
"167511726988577124144650172376153237830",
"201093296828010501114284909415942315991",
"194398000043691101049808631408176113440",
"87444791817345919612377931340250762870"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-3ff0bed9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140653178529060812317912478216494880203",
"length": 5598
},
"id": "CVE-2025-55297-4ae7a2ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c",
"function": "example_event_callback"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140653178529060812317912478216494880203",
"length": 5598
},
"id": "CVE-2025-55297-4cb0e6b7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c",
"function": "example_event_callback"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175734929258255810412998393423740844326",
"length": 2298
},
"id": "CVE-2025-55297-50c067fb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c",
"function": "blufi_dh_negotiate_data_handler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175734929258255810412998393423740844326",
"length": 2298
},
"id": "CVE-2025-55297-5a4ef79e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c",
"function": "blufi_dh_negotiate_data_handler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175734929258255810412998393423740844326",
"length": 2298
},
"id": "CVE-2025-55297-5c56fd99",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c",
"function": "blufi_dh_negotiate_data_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211932293721256966202710578094585543330",
"28187307207019347713287212980142431898",
"56313507085585402283193128946025108122",
"225792548284340363886924199780993309268",
"169639000018978717495728407573969511779",
"299000735249834920223846289490553666550",
"22471409609182823546259449643713415933",
"114025027611314480478009903225236664309",
"115088564007000263176049068429865578728",
"167511726988577124144650172376153237830",
"201093296828010501114284909415942315991",
"194398000043691101049808631408176113440",
"87444791817345919612377931340250762870"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-63d7afef",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140653178529060812317912478216494880203",
"length": 5598
},
"id": "CVE-2025-55297-6f0a8303",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c",
"function": "example_event_callback"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211932293721256966202710578094585543330",
"28187307207019347713287212980142431898",
"56313507085585402283193128946025108122",
"225792548284340363886924199780993309268",
"169639000018978717495728407573969511779",
"299000735249834920223846289490553666550",
"22471409609182823546259449643713415933",
"114025027611314480478009903225236664309",
"115088564007000263176049068429865578728",
"167511726988577124144650172376153237830",
"201093296828010501114284909415942315991",
"194398000043691101049808631408176113440",
"87444791817345919612377931340250762870"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-7c4780c8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211932293721256966202710578094585543330",
"28187307207019347713287212980142431898",
"56313507085585402283193128946025108122",
"225792548284340363886924199780993309268",
"169639000018978717495728407573969511779",
"299000735249834920223846289490553666550",
"22471409609182823546259449643713415933",
"114025027611314480478009903225236664309",
"115088564007000263176049068429865578728",
"167511726988577124144650172376153237830",
"201093296828010501114284909415942315991",
"194398000043691101049808631408176113440",
"87444791817345919612377931340250762870"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-8a7eb3c3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140653178529060812317912478216494880203",
"length": 5598
},
"id": "CVE-2025-55297-9c445961",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c",
"function": "example_event_callback"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175734929258255810412998393423740844326",
"length": 2298
},
"id": "CVE-2025-55297-b724b30e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c",
"function": "blufi_dh_negotiate_data_handler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175734929258255810412998393423740844326",
"length": 2298
},
"id": "CVE-2025-55297-d57bcaa1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/cb6929a2e6f2ff130b742332dc15eb23006c7cc9",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c",
"function": "blufi_dh_negotiate_data_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"156718069195225552601309518493754853400",
"4651273288141566203432787391121677576",
"5450208424883404953253788947636113072",
"212250662498059847845573964628673736154",
"140443780821930965946982575988969922783",
"125483958846573307628727124779218251622",
"192589945895917643578248128019074152363",
"23025681073281916378065892596205255988",
"265090150793358509237187042393682248086",
"98850339263440219764764085097559643670",
"28706277393444943867421732117850720742",
"319014018412117820981892491866096122588",
"11535038317845881545672410981899497224",
"132299173107655464416739961996593942283",
"62475831688793100973146978827325373036",
"239959748408126982566592479045931394852",
"312409216813545517587353631923860324521",
"177367434480545604463513578326446377267"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-de948eb3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"156718069195225552601309518493754853400",
"4651273288141566203432787391121677576",
"5450208424883404953253788947636113072",
"212250662498059847845573964628673736154",
"140443780821930965946982575988969922783",
"125483958846573307628727124779218251622",
"192589945895917643578248128019074152363",
"23025681073281916378065892596205255988",
"265090150793358509237187042393682248086",
"98850339263440219764764085097559643670",
"28706277393444943867421732117850720742",
"319014018412117820981892491866096122588",
"11535038317845881545672410981899497224",
"132299173107655464416739961996593942283",
"62475831688793100973146978827325373036",
"239959748408126982566592479045931394852",
"312409216813545517587353631923860324521",
"177367434480545604463513578326446377267"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-e0174993",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211932293721256966202710578094585543330",
"28187307207019347713287212980142431898",
"56313507085585402283193128946025108122",
"225792548284340363886924199780993309268",
"169639000018978717495728407573969511779",
"299000735249834920223846289490553666550",
"22471409609182823546259449643713415933",
"114025027611314480478009903225236664309",
"115088564007000263176049068429865578728",
"167511726988577124144650172376153237830",
"201093296828010501114284909415942315991",
"194398000043691101049808631408176113440",
"87444791817345919612377931340250762870"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-e3293d38",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "140653178529060812317912478216494880203",
"length": 5598
},
"id": "CVE-2025-55297-eff8fce2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c",
"function": "example_event_callback"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211932293721256966202710578094585543330",
"28187307207019347713287212980142431898",
"56313507085585402283193128946025108122",
"225792548284340363886924199780993309268",
"169639000018978717495728407573969511779",
"299000735249834920223846289490553666550",
"22471409609182823546259449643713415933",
"114025027611314480478009903225236664309",
"115088564007000263176049068429865578728",
"167511726988577124144650172376153237830",
"201093296828010501114284909415942315991",
"194398000043691101049808631408176113440",
"87444791817345919612377931340250762870"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-f07dd7aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/f77da0d5b5382635c99e6708551b73802ad1213d",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_security.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"156718069195225552601309518493754853400",
"4651273288141566203432787391121677576",
"5450208424883404953253788947636113072",
"212250662498059847845573964628673736154",
"140443780821930965946982575988969922783",
"125483958846573307628727124779218251622",
"192589945895917643578248128019074152363",
"23025681073281916378065892596205255988",
"265090150793358509237187042393682248086",
"98850339263440219764764085097559643670",
"28706277393444943867421732117850720742",
"319014018412117820981892491866096122588",
"11535038317845881545672410981899497224",
"132299173107655464416739961996593942283",
"62475831688793100973146978827325373036",
"239959748408126982566592479045931394852",
"312409216813545517587353631923860324521",
"177367434480545604463513578326446377267"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-f3e24ac7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/e65cf7ea2a2be52219ec9d4efc44aed5e490e91c",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"156718069195225552601309518493754853400",
"4651273288141566203432787391121677576",
"5450208424883404953253788947636113072",
"212250662498059847845573964628673736154",
"140443780821930965946982575988969922783",
"125483958846573307628727124779218251622",
"192589945895917643578248128019074152363",
"23025681073281916378065892596205255988",
"265090150793358509237187042393682248086",
"287347430840468246038638054527124678212",
"303432543401372844844901516707360859542",
"182481930880507031452989989164542119878",
"28706277393444943867421732117850720742",
"319014018412117820981892491866096122588",
"11535038317845881545672410981899497224",
"132299173107655464416739961996593942283",
"62475831688793100973146978827325373036",
"239959748408126982566592479045931394852",
"312409216813545517587353631923860324521",
"177367434480545604463513578326446377267"
],
"threshold": 0.9
},
"id": "CVE-2025-55297-f4bef7c6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919",
"target": {
"file": "examples/bluetooth/blufi/main/blufi_example_main.c"
}
}
]
"2026-10-06T08:02:41Z"