CVE-2025-65501: Null Pointer Dereference
Null pointer dereference in coapdtlsinfocallback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSLgetappdata() returns NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.5-2 - Upgrade
Upgrade
debian/libcoap3to a version that resolves this vulnerability.Fixed in 4.3.4-1.1+deb13u3Fixed in 4.3.5-4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65501?
CVE-2025-65501 is classified as a denial of service vulnerability affecting OISM libcoap 4.3.5.
How does CVE-2025-65501 affect OISM libcoap?
CVE-2025-65501 allows remote attackers to cause a denial of service via a null pointer dereference during a DTLS handshake.
How do I fix CVE-2025-65501?
To fix CVE-2025-65501, upgrade OISM libcoap to a version that addresses this vulnerability.
What functions are involved in CVE-2025-65501?
The vulnerability in CVE-2025-65501 is triggered during the execution of the coap_dtls_info_callback() and involves the SSL_get_app_data() function.
Can CVE-2025-65501 be exploited remotely?
Yes, CVE-2025-65501 can be exploited remotely by attackers attempting to perform a DTLS handshake.