CVE-2025-59391: Medium severity libcoap vulnerability
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libcoapto a version that resolves this vulnerability.Fixed in release-4.3.5-patches
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59391?
CVE-2025-59391 is classified as a memory disclosure vulnerability that may allow attackers to read sensitive memory beyond string boundaries.
How do I fix CVE-2025-59391?
To fix CVE-2025-59391, upgrade to libcoap version 4.3.5 or later, which includes patches for this vulnerability.
What software is affected by CVE-2025-59391?
CVE-2025-59391 affects libcoap versions up to and including 4.3.5-patches.
What kind of attack can be executed using CVE-2025-59391?
An attacker could exploit CVE-2025-59391 by performing an out-of-bounds read to infer or disclose sensitive information from memory.
Is there a workaround for CVE-2025-59391?
A temporary workaround for CVE-2025-59391 is to avoid using the vulnerable configuration options until an upgrade can be applied.