Executive brief
ccoap is a CoAP (Constrained Application Protocol) library used in IoT and embedded systems for lightweight communication. A vulnerability in the option parsing logic causes the library to crash with a segmentation fault when processing specially crafted CoAP messages with invalid option numbers, potentially leading to denial of service attacks that disrupt device communication and availability.
Technical details
The vulnerability is a segmentation fault (memory safety issue) in ccoap's option parsing logic that occurs when processing CoAP messages containing invalid option numbers. The root cause is improper bounds checking or validation of option numbers during message parsing. The attack vector is network-based: an attacker can send a malformed CoAP message to a system running vulnerable ccoap, triggering the crash without authentication. The impact is denial of service—affected devices become unresponsive. A patch status is unknown from the advisory text.
Affected products
- ipflavors ccoap commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5
Timeline
- 2026-08-27: disclosed