CVE-2026-23749 Details
Description
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).
A vulnerability exists in Golioth Firmware SDK versions 0.19.1 prior to 0.22.0, allowing for an out-of-bounds read. This issue arises from improper null termination of a blockwise transfer path. The function blockwise_transfer_init() accepts a path of length CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and uses strncpy() to copy it, without ensuring a trailing null byte. This leaves the context path unterminated. Subsequently, a strlen() operation on this buffer in golioth_coap_client_get_internal() can read past the allocated memory, leading to a crash and denial-of-service condition. The vulnerability is triggered by application-controlled input, not network input by default.
Users can upgrade to Golioth Firmware SDK version 0.22.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 26, 2026CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-170 | Improper Null Termination | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Golioth Firmware SDK | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 27, 2026 | CVE Modified | [email protected] |
| Feb 26, 2026 | CVE Modified | [email protected] |
| Feb 26, 2026 | New CVE Received | [email protected] |