# CVE-2026-26456: ccoap null pointer dereference in session management

Source: https://junglewise.ai/threats/cve-2026-26456-ccoap-null-pointer-dereference-in-session-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26456 · Severity: high · CVSS 7.5 · Published 2026-08-27

ccoap is a CoAP (Constrained Application Protocol) library used in IoT and embedded systems to enable lightweight communication. A race condition in the server's session management logic allows a remote attacker to crash the server with specially timed requests, disrupting service availability for all connected devices.

Technologies: [Ipflavors Ccoap](https://junglewise.ai/threats/technologies/ccoap). Vendors: [Ipflavors](https://junglewise.ai/threats/vendors/ipflavors).

## Quick answers

**Is CVE-2026-26456 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26456 being exploited in the wild.

**How severe is CVE-2026-26456?** High severity, with a CVSS score of 7.5, published 27 August 2026.

**Which products and versions are affected?** Ipflavors Ccoap commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5.

**Is there a fix for CVE-2026-26456?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26456 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26456?** Check whether you run Ipflavors Ccoap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A null pointer dereference vulnerability exists in ccoap's server-side session management due to a race condition between the request dispatch thread and the session cleanup thread. The threads access shared session list nodes without proper synchronization; one thread may dereference a session pointer while another concurrently clears the same node's data pointer. This results in a segmentation fault when the first thread attempts to access the now-null pointer. A remote attacker can trigger the race condition by sending specially crafted or timed CoAP requests, causing a denial-of-service. No patch is currently referenced in available advisories.

## Affected products

- ipflavors ccoap commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5

## Timeline

- 2026-08-27: disclosed

## References

- [https://github.com/ipflavors/ccoap](https://github.com/ipflavors/ccoap)
- [https://github.com/songxpu/bug_report/blob/master/CoAP/ccoap/VULNERABILITY_REPORT5.md](https://github.com/songxpu/bug_report/blob/master/CoAP/ccoap/VULNERABILITY_REPORT5.md)

## Related threats

- [ccoap segmentation fault in option parsing](https://junglewise.ai/threats/cve-2026-26459-ccoap-segmentation-fault-in-option-parsing)
- [ccoap null pointer dereference in coap_dump_msg](https://junglewise.ai/threats/cve-2026-26457-ccoap-null-pointer-dereference-in-coap-dump-msg)
- [ccoap null pointer dereference in URI_PATH processing](https://junglewise.ai/threats/cve-2026-26453-ccoap-null-pointer-dereference-in-uri-path-processing)
- [ccoap segmentation fault in option parsing](https://junglewise.ai/threats/cve-2026-26452-ccoap-segmentation-fault-in-option-parsing)