Home

Description

libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).

PUBLISHED Reserved 2025-04-15 | Published 2025-12-31 | Updated 2026-01-02 | Assigner VulnCheck




HIGH: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-121 Stack-based Buffer Overflow

Product status

Default status
unaffected

Any version
affected

commit 30db3ea
unaffected

Credits

SecMate finder

References

github.com/obgm/libcoap/pull/1737 issue-tracking

github.com/obgm/libcoap/commit/30db3ea patch

libcoap.net/ product

www.vulncheck.com/...address-resolution-dos-or-potential-rce third-party-advisory

cve.org (CVE-2025-34468)

nvd.nist.gov (CVE-2025-34468)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.