CVE-2026-26456: Null Pointer Dereference
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes without proper synchronization.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Servers running the affected ccoap revision 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 are exposed because the flaw is in server-side session management.
What conditions are required to trigger the vulnerability?
The race requires concurrent access to shared session-list nodes by the request dispatch thread and the session cleanup thread. The provided information does not specify any particular request format, authentication requirement, or configuration prerequisite.
What is the likely effect of successful exploitation?
The race can cause a null pointer dereference in the server-side session-management logic. The supplied data does not state impacts beyond that dereference.