# CVE-2026-29013: libcoap out-of-bounds read in OSCORE CBOR unwrap handling

Source: https://junglewise.ai/threats/cve-2026-29013-libcoap-out-of-bounds-read-in-oscore-cbor-unwrap-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-17. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-29013 · Severity: critical · CVSS 9.8 · Published 2026-04-17

libcoap is a popular library used to implement the Constrained Application Protocol (CoAP) for Internet of Things (IoT) devices. A vulnerability in how it handles secure communication (OSCORE) could allow an attacker to crash a device or potentially access sensitive information by sending specially crafted network requests. This could lead to service outages or data exposure in environments using IoT sensors and controllers.

Technologies: [Libcoap](https://junglewise.ai/threats/technologies/libcoap). Vendors: [Libcoap](https://junglewise.ai/threats/vendors/libcoap).

## Quick answers

**Is CVE-2026-29013 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29013 being exploited in the wild.

**How severe is CVE-2026-29013?** Critical severity, with a CVSS score of 9.8, published 17 April 2026.

**Which products and versions are affected?** obgm libcoap up to (excluding) 4.3.5b.

**Is there a fix for CVE-2026-29013?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-29013 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-29013?** Check whether you run Libcoap. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

libcoap is vulnerable to an out-of-bounds read in its OSCORE implementation, specifically within the CBOR unwrap handling in 'src/oscore/oscore_cbor.c'. The 'get_byte_inc()' function relies on 'assert()' for bounds checking; however, these assertions are stripped in production builds compiled with NDEBUG. A remote, unauthenticated attacker can exploit this by sending crafted CoAP requests with malformed OSCORE options or responses during negotiation. This can trigger out-of-bounds reads during CBOR parsing or cause integer wraparound during allocation size computation, potentially leading to memory corruption or information disclosure. A patch is available in the project's repository.

## Affected products

- obgm libcoap up to (excluding) 4.3.5b

## Timeline

- 2026-04-17: disclosed
- 2026-04-17: advisory
- 2026-06-02: other: NIST initial analysis completed

## References

- [https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718](https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718)

## Related threats

- [libcoap stack buffer overflow in address resolution](https://junglewise.ai/threats/cve-2025-34468-libcoap-stack-buffer-overflow-in-address-resolution)
- [A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before…](https://junglewise.ai/threats/cve-2025-59391-a-memory-disclosure-vulnerability-exists-in-libcoap-s-oscore)