CVE-2025-59391
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to read memory beyond string boundaries in the .rodata section.
Risk Assessment
This could potentially lead to information disclosure or denial of service, potentially exposing data or affecting service availability.
Recommendation
Update libcoap to release-4.3.5-patches or later to fix the vulnerability.
Other vulnerabilities in libcoap
See all- CVE-2025-34468Critical
A stack-based buffer overflow exists in libcoap versions up to 4.3.5 (before commit 30db3ea) during address resolution. A remote attacker can trigger a crash or potentially achieve remote code execution if proxy logic is enabled in the application.
- CVE-2023-35862Medium
Version 4.3.1 of the libcoap library contains a buffer over-read vulnerability in the coap_parse_oscore_conf_mem function in coap_oscore.c.
Original NVD description (English source)
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS