CVE-2025-65501
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL.
Risk Assessment
An attacker could remotely crash the application or service, leading to system unavailability. This may disrupt operations and expose the organization to losses.
Recommendation
Update libcoap to a version that fixes this vulnerability. Implement monitoring for unexpected restarts and DTLS errors.
Other vulnerabilities in OISM libcoap
See all- CVE-2025-65500Medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.
- CVE-2025-65499Medium
Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_ex_data_X509_STORE_CTX_idx() to return -1.
- CVE-2025-65495High
In OISM libcoap 4.3.5, the tls_verify_call_back() function in src/coap_openssl.c contains an integer signedness error. A crafted TLS certificate causes i2d_X509() to return -1, which is misused as a malloc() size parameter, enabling a remote denial of service attack.
- CVE-2025-65494High
In OISM libcoap 4.3.5, the get_san_or_cn_from_cert() function in src/coap_openssl.c contains a NULL pointer dereference. A crafted X.509 certificate causes sk_GENERAL_NAME_value() to return NULL, leading to a remote denial of service attack.
Original NVD description (English source)
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS