CVE-2026-23749

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23749
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).

2.9 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/
https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d
https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0
https://secmate.dev/disclosures/SECMATE-2025-0017
https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read
Configurations

No configuration.

History

15 Apr 2026, 00:35

Type Values Removed Values Added
Summary
  • (es) Golioth Firmware SDK versión 0.19.1 anterior a la 0.22.0, corregido en el commit 0e788217, contiene una lectura fuera de límites debido a una terminación nula incorrecta de una ruta de transferencia por bloques. blockwise_transfer_init() acepta una ruta cuya longitud es igual a CONFIG_GOLIOTH_COAP_MAX_PATH_LEN y la copia usando strncpy() sin garantizar un byte NUL final, dejando ctx->path sin terminar. Un strlen() posterior en este búfer (en golioth_coap_client_get_internal()) puede leer más allá del final de la asignación, lo que resulta en un fallo/denegación de servicio. La entrada es controlada por la aplicación (no por la red por defecto).

27 Feb 2026, 15:16

Type Values Removed Values Added
References
  • () https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/ -

26 Feb 2026, 19:32

Type Values Removed Values Added
References
  • () https://secmate.dev/disclosures/SECMATE-2025-0017 -

26 Feb 2026, 18:23

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-26 18:23

Updated : 2026-04-15 00:35

NVD link : CVE-2026-23749

Mitre link : CVE-2026-23749

CVE.ORG link : CVE-2026-23749

JSON object : View

Products Affected

No product.

CWE
CWE-170

Improper Null Termination