# CVE-2025-34468: libcoap stack buffer overflow in address resolution

Source: https://junglewise.ai/threats/cve-2025-34468-libcoap-stack-buffer-overflow-in-address-resolution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-31. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-34468 · Severity: critical · CVSS 9.8 · Published 2025-12-31

libcoap is a software library used by embedded and IoT devices to communicate using the Constrained Application Protocol (CoAP). A security flaw allows a remote attacker to send a specially crafted request that can crash the device or potentially take control of it. This issue specifically affects applications that have proxy features enabled.

Technologies: [Libcoap](https://junglewise.ai/threats/technologies/libcoap). Vendors: [Libcoap](https://junglewise.ai/threats/vendors/libcoap).

## Quick answers

**Is CVE-2025-34468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-34468 being exploited in the wild.

**How severe is CVE-2025-34468?** Critical severity, with a CVSS score of 9.8, published 31 December 2025.

**Which products and versions are affected?** obgm libcoap <= 4.3.5.

**Is there a fix for CVE-2025-34468?** A patch was published on 2025-09-12: Fix merged into develop branch via commit 30db3ea Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-34468 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-34468?** Check whether you run Libcoap. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in libcoap's address resolution logic, specifically within the coap_resolve_address_info and coap_split_uri functions. The vulnerability occurs when attacker-controlled hostname data exceeding 255 bytes is copied into a fixed 256-byte stack buffer without adequate bounds checking. A remote, unauthenticated attacker can trigger this overflow if the application has proxy logic enabled. Successful exploitation can lead to a crash (DoS) or remote code execution (RCE), though RCE feasibility depends on local compiler mitigations and memory protections. The issue is addressed in commit 30db3ea and released in version 4.3.5a.

## Affected products

- obgm libcoap <= 4.3.5

## Timeline

- 2025-09-12: patched: Fix merged into develop branch via commit 30db3ea
- 2025-12-31: disclosed: CVE-2025-34468 published

## References

- [https://github.com/obgm/libcoap/commit/30db3ea](https://github.com/obgm/libcoap/commit/30db3ea)
- [https://github.com/obgm/libcoap/pull/1737](https://github.com/obgm/libcoap/pull/1737)
- [https://libcoap.net/](https://libcoap.net/)
- [https://www.vulncheck.com/advisories/libcoap-stack-based-buffer-overflow-in-address-resolution-dos-or-potential-rce](https://www.vulncheck.com/advisories/libcoap-stack-based-buffer-overflow-in-address-resolution-dos-or-potential-rce)

## Related threats

- [libcoap out-of-bounds read in OSCORE CBOR unwrap handling](https://junglewise.ai/threats/cve-2026-29013-libcoap-out-of-bounds-read-in-oscore-cbor-unwrap-handling)
- [A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before…](https://junglewise.ai/threats/cve-2025-59391-a-memory-disclosure-vulnerability-exists-in-libcoap-s-oscore)