CVE-2025-59391

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59391
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59391.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59391
Downstream
Published
2025-12-08T17:16:20.080Z
Modified
2026-03-13T03:39:25.251466Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
[none]
Details

A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.

References

Affected packages

Git / github.com/obgm/libcoap

Affected ranges

Type
GIT
Repo
https://github.com/obgm/libcoap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e3fdcdcfbd1588754fe9dd4b754ac9397260f0f9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.3.5a"
        }
    ]
}

Affected versions

Other
bsd-licensed
coap-lwip
coap-tinydtls
v4_1_1
v4.*
v4.1.1
v4.1.2
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.2.0-rc4
v4.2.1
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.3.0-rc4
v4.3.1
v4.3.1-rc1
v4.3.1-rc2
v4.3.2
v4.3.2-rc1
v4.3.2-rc2
v4.3.3
v4.3.4
v4.3.5
v4.3.5-rc1
v4.3.5-rc2
v4.3.5-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59391.json"