Executive brief
Eclipse Wakaama, a C implementation of the Lightweight M2M protocol used in IoT devices, is vulnerable to a denial-of-service attack. An unauthenticated remote attacker can send a specific sequence of network requests that forces the server to consume all available memory. This results in the server crashing or becoming unresponsive, potentially disrupting the operations of connected IoT devices and infrastructure.
Technical details
An unbounded memory allocation vulnerability exists in the CoAP Block1 handler within `coap/block.c`. The root cause is the lack of a maximum total size limit when handling fragmented CoAP messages. An unauthenticated remote attacker can exploit this by sending a sequence of Block1 PUT requests with incrementing block numbers over UDP. The server repeatedly reallocates and grows an accumulation buffer to append each block payload, eventually exhausting available system memory. This can be triggered via the registration endpoint. The issue is fixed in the snapshot/2026-05-26 release by implementing checks for a configurable maximum message size.
Affected products
- Eclipse Wakaama before snapshot/2026-05-26
Timeline
- 2026-03-25: other: Initial fix proposed in pull request
- 2026-05-07: patched: Fix merged into main branch
- 2026-05-26: advisory: Snapshot release containing the fix published
- 2026-07-02: disclosed: CVE published and NVD record created
References
- https://github.com/eclipse-wakaama/wakaama/commit/a83f1ca28fa090fbc03c3669fef40daf4f89cd03
- https://github.com/eclipse-wakaama/wakaama/pull/881
- https://github.com/eclipse-wakaama/wakaama/releases/tag/snapshots%2F2026-05-26
- https://www.vulncheck.com/advisories/eclipse-wakaama-coap-block1-handler-unbounded-memory-allocation-dos