CVE-2025-65496
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A NULL pointer dereference exists in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5. A remote attacker can cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
Risk Assessment
The vulnerability can cause unavailability of CoAP services using DTLS, disrupting IoT device communication. It is easily exploitable remotely by sending a crafted packet.
Recommendation
Update libcoap to a version containing the fix or apply a patch to coap_dtls_generate_cookie(). Until then, consider restricting access to the DTLS service.
Other vulnerabilities in libcoap
See all- CVE-2025-34468Critical
A stack-based buffer overflow exists in libcoap versions up to 4.3.5 (before commit 30db3ea) during address resolution. A remote attacker can trigger a crash or potentially achieve remote code execution if proxy logic is enabled in the application.
- CVE-2025-59391Medium
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to read memory beyond string boundaries in the .rodata section.
- CVE-2025-65498Medium
A NULL pointer dereference exists in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5. A remote attacker can cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
- CVE-2025-65497Medium
A NULL pointer dereference exists in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5. A remote attacker can cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
- CVE-2025-65493High
NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection that triggers BIO_get_data() to return NULL.
- CVE-2023-35862Medium
Version 4.3.1 of the libcoap library contains a buffer over-read vulnerability in the coap_parse_oscore_conf_mem function in coap_oscore.c.
Original NVD description (English source)
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS