Documentation for IDF v5.3.6 is available at https://docs.espressif.com/projects/esp-idf/en/v5.3.6/

ESP-IDF v5.3.6 is a bugfix release for ESP-IDF v5.3.

Obtaining v5.3.6

For full installation instructions, see the ESP-IDF Programming Guide.

Using EIM

The recommended way to obtain and install ESP-IDF v5.3.6 is through the ESP-IDF Installation Manager (EIM). EIM supports obtaining ESP-IDF releases from Espressif mirrors as well as directly from Git repositories.

eim install -i v5.3.6

Using git

To download this release using git, use the following command:

git clone -b v5.3.6 --recursive https://github.com/espressif/esp-idf.git esp-idf-v5.3.6

To install ESP-IDF build tools, use EIM:

eim install -p esp-idf-v5.3.6

or the legacy installation method.

Download an archive with submodules included

Attached to this release is an esp-idf-v5.3.6.zip archive. It includes .git directory and all the submodules, so can be used out of the box. This archive is provided for users who have connectivity issues preventing them from cloning from GitHub. To reduce the size of the archive, the .git directory doesn't include the history of commits older than one year. Users who need to use git checkout to access an older release of IDF will have to use git fetch first to download the remaining part of the history.

This archive can also be downloaded from Espressif's download server: https://dl.espressif.com/github_assets/espressif/esp-idf/releases/download/v5.3.6/esp-idf-v5.3.6.zip

Same as when downloading the release using git, you need to install the build tools using either EIM or the legacy installation method.

Note that the source files attached to this release will not work due to our use of git submodules.

Major changes

Major Enhancements

• Suggest to check release notes database and update

Vulnerability Fixes

• Application Utilities/ESP HTTP Server: Fixed a null pointer dereference issue in the websocket server that could lead to a crash when handling specific client headers. (d1894ab)
• Application Utilities/Protocomm: Fixed several issues in the protocomm module that could lead to device crashes during provisioning, including username length validation and null pointer dereferences. (1fcc904)
• Classic Bluetooth/Bluedroid: Fixed potential out-of-boundary read in parsing AVRCP vendor commands on AVRCP target (7ffd3ba)
• Classic Bluetooth/Bluedroid: Added buffer length check in L2CAP related functions to fix security risks on out-of-bounds memory read (5728b53)
• Classic Bluetooth/Bluedroid: Added check of buffer length in L2CAP message parsing to avoid out-of-bounds read and write (2f00d76)
• LWIP/DHCP Server: Fixed an out-of-bounds read issue in the DHCP server that could cause crashes with specially crafted packets, enhancing overall stability. (6388861)
• Peripheral Drivers/JPEG/JPEG Decoder: Improved the jpeg_decoder by adding strict checks to prevent potential bad picture attacks. (GHSA-v6r2-f6p2-88cj) (fea9e43)

Breaking Changes

• Security/Secure Boot: Disabled ECDSA Secure Boot V2 for ESP32-H2, ESP32-C5, ESP32-P4 which are in Mass Production stage, ( and some preview SoC ESP32-H4, ESP32-S31, ESP32-H21). This was done due to a security vulnerability found in the ECDSA based Secure Boot flow, more details will be available in the Chip Errata. (7e04a1b)

Changelog

This full changelog of v5.3.6 release is on The ESP Release Notes site now.