CVE-2025-34468
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A stack-based buffer overflow exists in libcoap versions up to 4.3.5 (before commit 30db3ea) during address resolution. A remote attacker can trigger a crash or potentially achieve remote code execution if proxy logic is enabled in the application.
Risk Assessment
The risk includes potential remote code execution (RCE) or denial of service (DoS) in applications using libcoap with proxy logic enabled. An attacker could take control of the system or cause service unavailability.
Recommendation
Immediately update libcoap to a version containing commit 30db3ea or later. If updating is not possible, disable proxy handling in applications using libcoap.
Original NVD description (English source)
libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).