CVE-2025-59391

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59391
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59391.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59391
Downstream
Published
2025-12-08T00:00:00Z
Modified
2026-07-22T00:51:49.916619Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
[none]
Details

A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59391.json"
}
References

Affected packages

Git / github.com/obgm/libcoap

Affected ranges

Type
GIT
Repo
https://github.com/obgm/libcoap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
851533c3cf63d16984d370ce39d586ecb3694971
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "release-4.3.5-patches"
        },
        {
            "fixed": "4.3.5a"
        }
    ],
    "cpe": "cpe:2.3:a:libcoap:libcoap:*:*:*:*:*:*:*:*",
    "source": [
        "DESCRIPTION",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other
coap-lwip
v4_1_1
v4.*
v4.1.1
v4.1.2
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.2.0-rc4
v4.2.1
v4.3.2
v4.3.2-rc1
v4.3.2-rc2
v4.3.3
v4.3.4
v4.3.5
v4.3.5-rc1
v4.3.5-rc2
v4.3.5-rc3
v4.3.5a

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1292.0,
            "function_hash": "85326049542284814399856562787741768727"
        },
        "id": "CVE-2025-59391-14a69ac7",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_send",
            "file": "src/coap_mbedtls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2188.0,
            "function_hash": "306736978701644454561638712225277067477"
        },
        "id": "CVE-2025-59391-261a61fc",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_write",
            "file": "src/coap_wolfssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "15411908909958860775211265335536427407",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620",
                "116536891256688770484001069192968141501",
                "134947761608587716712991501324028267856",
                "81678169831583961286977954233385664527",
                "116849850931191068750177515966678256220",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620",
                "313318359985536302471801617405965022092",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620",
                "116536891256688770484001069192968141501",
                "134947761608587716712991501324028267856",
                "81678169831583961286977954233385664527",
                "313318359985536302471801617405965022092",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620"
            ]
        },
        "id": "CVE-2025-59391-33d6c428",
        "signature_type": "Line",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "file": "src/coap_wolfssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "337904441687869165843535038722711579335",
                "304681457350559555706899635762218481995",
                "110383702419857218658550560659283847622",
                "280764313674571414571564296107986116350",
                "260201155156599315831660544597187697792",
                "237150004119747413224444641434797487728",
                "26961578324912790942126112320517345898",
                "66684850357476544012692063845321115306",
                "106183898905765163754583739743222052929",
                "170919558706517679028022730513223874599",
                "116386489271052775311612969382955059435",
                "282613876025531397485030245403164080916",
                "145270543694757249718495051150710556030",
                "304681457350559555706899635762218481995",
                "110383702419857218658550560659283847622",
                "280764313674571414571564296107986116350",
                "260201155156599315831660544597187697792",
                "145270543694757249718495051150710556030",
                "304681457350559555706899635762218481995",
                "110383702419857218658550560659283847622",
                "280764313674571414571564296107986116350",
                "260201155156599315831660544597187697792",
                "237150004119747413224444641434797487728",
                "26961578324912790942126112320517345898",
                "66684850357476544012692063845321115306",
                "145270543694757249718495051150710556030",
                "304681457350559555706899635762218481995",
                "110383702419857218658550560659283847622",
                "280764313674571414571564296107986116350",
                "260201155156599315831660544597187697792"
            ]
        },
        "id": "CVE-2025-59391-34f6744f",
        "signature_type": "Line",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "file": "src/coap_mbedtls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1214.0,
            "function_hash": "91326830784992737475680710694707116123"
        },
        "id": "CVE-2025-59391-45242826",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_send",
            "file": "src/coap_gnutls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2347.0,
            "function_hash": "26430849427469556451136376777718145170"
        },
        "id": "CVE-2025-59391-490458a7",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_read",
            "file": "src/coap_wolfssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "23031380702055205930316498110125306054",
                "34378583416927325614830432188681466307",
                "279146812373370674349054110943019686116",
                "171625597872910728004536992034728778681",
                "312943919646741470530525044446109984842",
                "332522464106056864701340573670213419036",
                "45989790058782624768189185181864209162",
                "98058673563965097939786667199771668346",
                "39696012473944314118650810272553802704",
                "246188265563190334208842778449331505997",
                "70970862817180733918113699814896602943",
                "279146812373370674349054110943019686116",
                "132753285705974266946915529153894719367",
                "216141987605081778056913603438184117426"
            ]
        },
        "id": "CVE-2025-59391-4cf2dc64",
        "signature_type": "Line",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "file": "src/coap_tinydtls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1644.0,
            "function_hash": "292531550078019844896041999038719597629"
        },
        "id": "CVE-2025-59391-706c0010",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_write",
            "file": "src/coap_gnutls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1691.0,
            "function_hash": "21776863930825372101923181712764214740"
        },
        "id": "CVE-2025-59391-712f2490",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_read",
            "file": "src/coap_gnutls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1721.0,
            "function_hash": "123123615217698491116894614054529509886"
        },
        "id": "CVE-2025-59391-8032e978",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_read",
            "file": "src/coap_mbedtls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1144.0,
            "function_hash": "243687100477660245376362105986385717485"
        },
        "id": "CVE-2025-59391-83b56253",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_receive",
            "file": "src/coap_tinydtls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2908.0,
            "function_hash": "212547978384719786255233504667115321999"
        },
        "id": "CVE-2025-59391-92d9e275",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_receive",
            "file": "src/coap_wolfssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2314.0,
            "function_hash": "69576481631951111685028577390359454494"
        },
        "id": "CVE-2025-59391-96c2892b",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_write",
            "file": "src/coap_openssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1429.0,
            "function_hash": "33563004650523345432675580502379313629"
        },
        "id": "CVE-2025-59391-9a254090",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_send",
            "file": "src/coap_openssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2180.0,
            "function_hash": "62577777721189041801822773906509644626"
        },
        "id": "CVE-2025-59391-aeaf7c79",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_receive",
            "file": "src/coap_gnutls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1268.0,
            "function_hash": "53159726183479920923849338954582782305"
        },
        "id": "CVE-2025-59391-b3cc0b6f",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_send",
            "file": "src/coap_tinydtls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 205.0,
            "function_hash": "332227376013851657869784690061081720703"
        },
        "id": "CVE-2025-59391-b6e4875f",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dgram_destroy",
            "file": "src/coap_openssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "228786392259244641228734032934904780662",
                "147523157495900877670261885925168230258",
                "274004364396085238039277557504504360751",
                "243584047675722518274780453976884872415",
                "316713216995309952059170077154033832999",
                "320611148643336054835590721458452056095",
                "302011017503512693175439017717461116647",
                "292891296865426260604046022276368703977",
                "230625849031722816986402087332575496535",
                "284678711105798280628671396721516681294",
                "323488070396003554448137350098952839075",
                "15411908909958860775211265335536427407",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620",
                "116536891256688770484001069192968141501",
                "134947761608587716712991501324028267856",
                "81678169831583961286977954233385664527",
                "246891808803424668580015653032779311636",
                "112987783015174694802545845404680311345",
                "40564534837348066573672403462459524202",
                "129737476834047468114495478589610197958",
                "157315502960125796006743010604178644195",
                "93273170937260253080487266157097258389",
                "318568369596440574502441282311675373682",
                "54887952225474782336202312518365773955",
                "327813439605604673563040909498457788576",
                "105168350939195450450982919117347968160",
                "220268690295836453743650173385787328342",
                "224345847398824450692939426554678706137",
                "37315100012202224297509390738082288814",
                "115133386853268709054882557872202831658",
                "300974842540064882699480831770012553051",
                "116849850931191068750177515966678256220",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620",
                "45119872330899513837839042929631692459",
                "124698168619203789640236191387417845590",
                "313318359985536302471801617405965022092",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620",
                "116536891256688770484001069192968141501",
                "134947761608587716712991501324028267856",
                "81678169831583961286977954233385664527",
                "313318359985536302471801617405965022092",
                "99880862791964072525732958960222585695",
                "22658195037501002509538246257648260479",
                "178859116538714066501284222569954212262",
                "309082969704580375241127243412916075620",
                "116536891256688770484001069192968141501",
                "134947761608587716712991501324028267856"
            ]
        },
        "id": "CVE-2025-59391-b8eb784b",
        "signature_type": "Line",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "file": "src/coap_openssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2651.0,
            "function_hash": "250611704829397383855490180259296588716"
        },
        "id": "CVE-2025-59391-c112c914",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_receive",
            "file": "src/coap_openssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2194.0,
            "function_hash": "15776374160949478909324118090219155812"
        },
        "id": "CVE-2025-59391-c34a6555",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_read",
            "file": "src/coap_openssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2134.0,
            "function_hash": "236662025558247763740982530323169619238"
        },
        "id": "CVE-2025-59391-c3de0290",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_receive",
            "file": "src/coap_mbedtls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1069.0,
            "function_hash": "277881577929113743393994050608192386535"
        },
        "id": "CVE-2025-59391-d91579f0",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_dtls_send",
            "file": "src/coap_wolfssl.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "260201155156599315831660544597187697792",
                "237150004119747413224444641434797487728",
                "26961578324912790942126112320517345898",
                "66684850357476544012692063845321115306",
                "145270543694757249718495051150710556030",
                "304681457350559555706899635762218481995",
                "110383702419857218658550560659283847622",
                "280764313674571414571564296107986116350",
                "260201155156599315831660544597187697792",
                "145270543694757249718495051150710556030",
                "304681457350559555706899635762218481995",
                "110383702419857218658550560659283847622",
                "280764313674571414571564296107986116350",
                "260201155156599315831660544597187697792",
                "237150004119747413224444641434797487728",
                "26961578324912790942126112320517345898",
                "66684850357476544012692063845321115306",
                "145270543694757249718495051150710556030",
                "304681457350559555706899635762218481995",
                "110383702419857218658550560659283847622",
                "280764313674571414571564296107986116350",
                "260201155156599315831660544597187697792"
            ]
        },
        "id": "CVE-2025-59391-eea6ea75",
        "signature_type": "Line",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "file": "src/coap_gnutls.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1699.0,
            "function_hash": "24544517956092318288850958517713751891"
        },
        "id": "CVE-2025-59391-f6da2924",
        "signature_type": "Function",
        "source": "https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971",
        "target": {
            "function": "coap_tls_write",
            "file": "src/coap_mbedtls.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-22T00:51:49Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59391.json"