Executive brief
ccoap is a CoAP (Constrained Application Protocol) library used in IoT and embedded systems. A vulnerability in the message handling function allows a remote attacker to crash the server by sending specially crafted CoAP messages with malformed URI options, causing a denial of service and potentially disrupting connected devices or applications.
Technical details
The vulnerability is a null pointer dereference in the coap_server_handle_session() function (server.c, lines 666–674). When processing CoAP messages, the code searches for URI_PATH options and calls strncmp() on the option's data pointer without first checking if it is NULL. The data pointer can become NULL in edge cases such as zero-length options where malloc(0) returns NULL, or malformed messages with insufficient data. An attacker on the network can send a CoAP message containing a URI_PATH option with a NULL data pointer, causing strncmp() to dereference the NULL pointer and trigger a segmentation fault. The fix involves adding a NULL pointer check before the strncmp() call. No patch is currently available in the publicly available codebase.
Affected products
- ipflavors ccoap commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 and likely earlier versions
Timeline
- 2026-08-27: disclosed: Published to NVD