CVE-2025-65499: Out-of-bounds Read
Array index error in tlsverifycallback() in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSLgetexdataX509STORECTXidx() to return -1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.5-2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u3Fixed in 4.3.5-4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65499?
CVE-2025-65499 is categorized as a denial of service vulnerability due to an array index error.
How do I fix CVE-2025-65499?
To fix CVE-2025-65499, upgrade to version 4.3.6 or later of OISM libcoap.
What causes the CVE-2025-65499 vulnerability?
CVE-2025-65499 arises from an array index error in the tls_verify_call_back() function during a DTLS handshake.
Can CVE-2025-65499 be exploited remotely?
Yes, CVE-2025-65499 can be exploited by remote attackers through a crafted DTLS handshake.
Which version of OISM libcoap is affected by CVE-2025-65499?
OISM libcoap version 4.3.5 is affected by CVE-2025-65499.