Executive brief
ccoap is a CoAP (Constrained Application Protocol) library used in IoT and embedded systems to enable lightweight communication. A race condition in the server's session management logic allows a remote attacker to crash the server with specially timed requests, disrupting service availability for all connected devices.
Technical details
A null pointer dereference vulnerability exists in ccoap's server-side session management due to a race condition between the request dispatch thread and the session cleanup thread. The threads access shared session list nodes without proper synchronization; one thread may dereference a session pointer while another concurrently clears the same node's data pointer. This results in a segmentation fault when the first thread attempts to access the now-null pointer. A remote attacker can trigger the race condition by sending specially crafted or timed CoAP requests, causing a denial-of-service. No patch is currently referenced in available advisories.
Affected products
- ipflavors ccoap commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5
Timeline
- 2026-08-27: disclosed