Executive brief
libcoap is a software library used by embedded and IoT devices to communicate using the Constrained Application Protocol (CoAP). A security flaw allows a remote attacker to send a specially crafted request that can crash the device or potentially take control of it. This issue specifically affects applications that have proxy features enabled.
Technical details
A stack-based buffer overflow exists in libcoap's address resolution logic, specifically within the coap_resolve_address_info and coap_split_uri functions. The vulnerability occurs when attacker-controlled hostname data exceeding 255 bytes is copied into a fixed 256-byte stack buffer without adequate bounds checking. A remote, unauthenticated attacker can trigger this overflow if the application has proxy logic enabled. Successful exploitation can lead to a crash (DoS) or remote code execution (RCE), though RCE feasibility depends on local compiler mitigations and memory protections. The issue is addressed in commit 30db3ea and released in version 4.3.5a.
Affected products
- obgm libcoap <= 4.3.5
Timeline
- 2025-09-12: patched: Fix merged into develop branch via commit 30db3ea
- 2025-12-31: disclosed: CVE-2025-34468 published