# CVE-2026-26453: ccoap null pointer dereference in URI_PATH processing

Source: https://junglewise.ai/threats/cve-2026-26453-ccoap-null-pointer-dereference-in-uri-path-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26453 · Severity: high · CVSS 7.5 · Published 2026-08-27

ccoap is a CoAP (Constrained Application Protocol) library used in IoT and embedded systems. A vulnerability in the message handling function allows a remote attacker to crash the server by sending specially crafted CoAP messages with malformed URI options, causing a denial of service and potentially disrupting connected devices or applications.

Technologies: [Ipflavors Ccoap](https://junglewise.ai/threats/technologies/ccoap). Vendors: [Ipflavors](https://junglewise.ai/threats/vendors/ipflavors).

## Quick answers

**Is CVE-2026-26453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26453 being exploited in the wild.

**How severe is CVE-2026-26453?** High severity, with a CVSS score of 7.5, published 27 August 2026.

**Which products and versions are affected?** Ipflavors Ccoap commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 and likely earlier versions.

**Is there a fix for CVE-2026-26453?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26453 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26453?** Check whether you run Ipflavors Ccoap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a null pointer dereference in the coap_server_handle_session() function (server.c, lines 666–674). When processing CoAP messages, the code searches for URI_PATH options and calls strncmp() on the option's data pointer without first checking if it is NULL. The data pointer can become NULL in edge cases such as zero-length options where malloc(0) returns NULL, or malformed messages with insufficient data. An attacker on the network can send a CoAP message containing a URI_PATH option with a NULL data pointer, causing strncmp() to dereference the NULL pointer and trigger a segmentation fault. The fix involves adding a NULL pointer check before the strncmp() call. No patch is currently available in the publicly available codebase.

## Affected products

- ipflavors ccoap commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 and likely earlier versions

## Timeline

- 2026-08-27: disclosed: Published to NVD

## References

- [https://github.com/ipflavors/ccoap](https://github.com/ipflavors/ccoap)
- [https://github.com/songxpu/bug_report/blob/master/CoAP/ccoap/VULNERABILITY_REPORT3.md](https://github.com/songxpu/bug_report/blob/master/CoAP/ccoap/VULNERABILITY_REPORT3.md)

## Related threats

- [ccoap segmentation fault in option parsing](https://junglewise.ai/threats/cve-2026-26459-ccoap-segmentation-fault-in-option-parsing)
- [ccoap null pointer dereference in coap_dump_msg](https://junglewise.ai/threats/cve-2026-26457-ccoap-null-pointer-dereference-in-coap-dump-msg)
- [ccoap null pointer dereference in session management](https://junglewise.ai/threats/cve-2026-26456-ccoap-null-pointer-dereference-in-session-management)
- [ccoap segmentation fault in option parsing](https://junglewise.ai/threats/cve-2026-26452-ccoap-segmentation-fault-in-option-parsing)