CVE-2025-65495: High severity OISM libcoap vulnerability
Integer signedness error in tlsverifycallback() in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes i2dX509() to return -1 and be misused as a malloc() size parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.5-2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u3Fixed in 4.3.5-4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65495?
CVE-2025-65495 is rated as a high severity vulnerability due to the potential for denial of service.
How do I fix CVE-2025-65495?
To fix CVE-2025-65495, update to the latest version of OISM libcoap where the vulnerability has been addressed.
What impact does CVE-2025-65495 have on OISM libcoap users?
CVE-2025-65495 allows remote attackers to cause a denial of service through a crafted TLS certificate.
Which versions of OISM libcoap are affected by CVE-2025-65495?
OISM libcoap version 4.3.5 is known to be vulnerable to CVE-2025-65495.
Can CVE-2025-65495 be exploited without authentication?
Yes, CVE-2025-65495 can be exploited by remote attackers without requiring authentication.