CVE-2023-35862
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Version 4.3.1 of the libcoap library contains a buffer over-read vulnerability in the coap_parse_oscore_conf_mem function in coap_oscore.c.
Risk Assessment
An attacker may exploit this vulnerability to read data outside the allocated memory space, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to update the libcoap library to the latest version to mitigate this vulnerability.
Other vulnerabilities in libcoap 4.3.1
See all- CVE-2025-34468Critical
A stack-based buffer overflow exists in libcoap versions up to 4.3.5 (before commit 30db3ea) during address resolution. A remote attacker can trigger a crash or potentially achieve remote code execution if proxy logic is enabled in the application.
- CVE-2025-59391Medium
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to read memory beyond string boundaries in the .rodata section.
Original NVD description (English source)
libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS