CVE-2026-26453: Null Pointer Dereference
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coapserverhandlesession() function when processing COAP messages containing URIPATH options with NULL data pointers. When the server searches for a URIPATH option matching the string "separate", it directly calls strncmp() on optionlist[i].data without checking if the pointer is NULL. This causes a segmentation fault when the option's data field is NULL.
Event History
Frequently Asked Questions
Who is exposed to this issue?
ccoap servers that process COAP messages and execute coap_server_handle_session() are exposed when they handle a URI_PATH option whose data pointer is NULL. The vulnerable behavior occurs during the search for a URI_PATH value matching "separate".
What does an attacker need to do to trigger the flaw?
An attacker needs to cause the server to process a COAP message containing a URI_PATH option with a NULL data pointer. When the affected code calls strncmp() on that pointer, the server can crash with a segmentation fault.
What is the likely security impact?
The described impact is a denial of service: dereferencing the NULL pointer causes a segmentation fault, which can terminate or disrupt the server session handling.