CVE-2025-65493: Null Pointer Dereference
NULL pointer dereference in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection that triggers BIOgetdata() to return NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.5-2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u3Fixed in 4.3.5-4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65493?
CVE-2025-65493 has a moderate severity level as it can lead to denial of service due to a NULL pointer dereference.
How do I fix CVE-2025-65493?
To fix CVE-2025-65493, update OISM libcoap to the latest version that addresses this vulnerability.
What software is affected by CVE-2025-65493?
CVE-2025-65493 affects OISM libcoap version 4.3.5.
Can CVE-2025-65493 be exploited remotely?
Yes, CVE-2025-65493 can be exploited remotely through a crafted DTLS/TLS connection.
What kind of attack does CVE-2025-65493 enable?
CVE-2025-65493 enables a denial of service attack by causing a crash via NULL pointer dereference.