Listen to this Post
The vulnerability CVE-2025-65501 is a null pointer dereference in the coap_dtls_info_callback() function within OISM libcoap version 4.3.5. This function handles DTLS handshake events for CoAP secure communications. During a DTLS handshake initiated by a remote attacker, the function calls SSL_get_app_data() to retrieve application-specific data from the SSL session. If SSL_get_app_data() returns NULL—due to unset or cleared application data—the code proceeds to dereference this null pointer without validation. This dereference causes a segmentation fault, crashing the application and resulting in denial of service. The issue is remotely exploitable as attackers can craft DTLS handshake messages that trigger the callback with NULL app data. The vulnerability affects systems using libcoap with DTLS enabled, typically in IoT devices for secure CoAP messaging. Exploitation does not require authentication, making it accessible to any remote attacker. The crash disrupts service availability, potentially leading to sustained outages if attacks are repeated. Patches must add a null check before using the pointer in coap_dtls_info_callback().
Platform: OISM libcoap
Version: 4.3.5
Vulnerability: Null pointer dereference
Severity: Critical
Date: 11/24/2025
Prediction: Patch expected 12/2025
What Undercode Say:
Analytics:
$ coap-server –version
$ openssl s_client -dtls -connect target:5684
// Code snippet: coap_dtls_info_callback() without null check
void coap_dtls_info_callback(SSL ssl, int where, int ret) {
app_data data = SSL_get_app_data(ssl);
coap_log(LOG_INFO, “Data: %s\n”, data->info); // Potential NULL dereference
}
how Exploit:
Send crafted DTLS handshake to trigger SSL_get_app_data() returning NULL, causing crash.
Protection from this CVE
Update libcoap version, add null check.
Impact:
Remote denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
