Listen to this Post
How the CVE Works
The vulnerability exists in the `libcoap` library’s DTLS/TLS integration within the `src/coap_openssl.c` file. When the library establishes a secure CoAP connection using OpenSSL’s BIO abstraction, it calls `BIO_get_data()` to retrieve internal session context. A malicious remote attacker can craft a specific sequence of packets during the DTLS/TLS handshake or session renegotiation that causes this function to return a NULL pointer. The libcoap code fails to validate this return value before dereferencing it to access structure members. This NULL pointer dereference triggers a segmentation fault in the application using the library, leading to an immediate and unconditional denial-of-service (DoS) crash. The attack requires no authentication and can be performed over the network, making affected devices unreachable.
dailycve form:
Platform: OISM libcoap
Version: 4.3.5
Vulnerability: NULL Pointer Dereference
Severity: Critical
date: 2025-11-24
Prediction: Patch 2025-12-15
What Undercode Say:
Analytics:
`$ pkg-config –modversion libcoap`
`$ strings /usr/lib/libcoap.so.3 | grep “libcoap [0-9]”`
`$ curl –coap –coap-version 1 -v coaps://`
How Exploit:
Send crafted DTLS ClientHello packets or trigger TLS renegotiation to a vulnerable `coap-server` instance or embedded device service. Exploit causes immediate process crash via SIGSEGV.
Protection from this CVE:
Upgrade to libcoap>=4.3.6. Disable DTLS if unused. Use network ACLs.
Impact:
Remote Denial-of-Service. Service crash. Availability loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
