CVE-2026-29013 Details
Description
libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation.
A vulnerability allowing out-of-bounds read has been identified in libcoap versions prior to 4.3.5b. This issue arises in the OSCORE Appendix B.2 CBOR unwrap handling, where the function get_byte_inc() in 'src/oscore/oscore_cbor.c' relies solely on assert() for bounds checking. This assertion is removed in release builds compiled with NDEBUG. Exploitation can occur when attackers send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation. This can trigger out-of-bounds reads during CBOR parsing, potentially leading to heap buffer overflow writes through integer wraparound in allocation size computation.
Users can upgrade to libcoap version 4.3.5b or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718 | [email protected] | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libcoap libcoap | < 4.3.5b |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | [email protected] |
| Apr 20, 2026 | CVE Modified | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |