CVE-2025-34468
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A stack-based buffer overflow exists in libcoap versions up to 4.3.5 (before commit 30db3ea) during address resolution. A remote attacker can trigger a crash or potentially achieve remote code execution if proxy logic is enabled in the application.
Risk Assessment
The risk includes potential remote code execution (RCE) or denial of service (DoS) in applications using libcoap with proxy logic enabled. An attacker could take control of the system or cause service unavailability.
Recommendation
Immediately update libcoap to a version containing commit 30db3ea or later. If updating is not possible, disable proxy handling in applications using libcoap.
Other vulnerabilities in libcoap
See all- CVE-2025-59391Medium
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to read memory beyond string boundaries in the .rodata section.
- CVE-2023-35862Medium
Version 4.3.1 of the libcoap library contains a buffer over-read vulnerability in the coap_parse_oscore_conf_mem function in coap_oscore.c.
Original NVD description (English source)
libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS