CVE-2026-29013

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29013
libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:libcoap:libcoap:*:*:*:*:*:*:*:*
History

02 Jun 2026, 16:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Libcoap libcoap
Libcoap
References () https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718 - () https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718 - Patch
CPE cpe:2.3:a:libcoap:libcoap:*:*:*:*:*:*:*:*

26 May 2026, 00:16

Type Values Removed Values Added
Summary (en) libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause heap buffer overflow writes through integer wraparound in allocation size computation. (en) libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation.

20 Apr 2026, 17:16

Type Values Removed Values Added
References
  • {'url': 'https://www.vulncheck.com/advisories/libcoap-out-of-bounds-read-in-oscore-cbor-unwrap-handling', 'source': 'disclosure@vulncheck.com'}

17 Apr 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-17 22:16

Updated : 2026-06-17 10:29

NVD link : CVE-2026-29013

Mitre link : CVE-2026-29013

CVE.ORG link : CVE-2026-29013

JSON object : View

Products Affected

libcoap

  • libcoap
CWE
CWE-125

Out-of-bounds Read