CVE-2025-65495
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In OISM libcoap 4.3.5, the tls_verify_call_back() function in src/coap_openssl.c contains an integer signedness error. A crafted TLS certificate causes i2d_X509() to return -1, which is misused as a malloc() size parameter, enabling a remote denial of service attack.
Risk Assessment
A remote attacker can crash a service using libcoap, causing denial of access for legitimate users. This affects IoT and embedded systems that use the library for CoAP over TLS communication.
Recommendation
Update libcoap to a version containing the fix or implement a workaround by validating certificates at the application level. Monitor for new releases of the library.
Other vulnerabilities in OISM libcoap
See all- CVE-2025-65501Medium
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL.
- CVE-2025-65500Medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
- CVE-2025-65499Medium
Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_ex_data_X509_STORE_CTX_idx() to return -1.
- CVE-2025-65494High
In OISM libcoap 4.3.5, the get_san_or_cn_from_cert() function in src/coap_openssl.c contains a NULL pointer dereference. A crafted X.509 certificate causes sk_GENERAL_NAME_value() to return NULL, leading to a remote denial of service attack.
Original NVD description (English source)
Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2d_X509() to return -1 and be misused as a malloc() size parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS