CVE-2021-28135: Espressif Esp-Idf

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.

Affected products

• Espressif Esp-Idf: up to and including 4.4

Published 2021-09-07. Last modified 2026-06-17.