CVE-2026-58465 Details

A memory exhaustion vulnerability has been identified in Eclipse Wakaama versions prior to snapshot 2026-05-26. The issue resides in the CoAP Block1 handler within 'coap/block.c', where the absence of limits on memory allocation allows unauthenticated remote attackers to deplete server resources. Exploitation involves sending a series of Block1 PUT requests with increasing block numbers to the registration endpoint over UDP. This process causes the server to continuously reallocate a growing buffer, appending each block's payload without any maximum size restriction, ultimately leading to a denial-of-service condition through memory exhaustion.

Users can update to the latest version of Eclipse Wakaama, which includes a patch for this vulnerability. The patched version is available in the 'snapshots/2026-05-26' release.