From e6be698a7a4547ee903e009ff3f7e99ed4f26ab9 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Thu, 9 Apr 2026 17:16:42 +0800 Subject: [PATCH] change(mbedtls): adds CVE-2025-66442 to exclude list. The CVE is applicable with Clang using LLVM's select-optimize feature. ESP-IDF uses GCC as default compiler and sets -Os as the default optimisation flag --- sbom.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sbom.yml b/sbom.yml index e22ca04689..416ba5005c 100644 --- a/sbom.yml +++ b/sbom.yml @@ -15,3 +15,5 @@ cve-exclude-list: reason: Fixed in 3.6.4 - cve: CVE-2025-27810 reason: Fixed in 3.6.3 + - cve: CVE-2025-66442 + reason: Applicable only with Clang with select-optimize feature. ESP-IDF uses gcc as the default compiler and uses -Os as the default optimisation flag