CVE-2026-26457: Null Pointer Dereference
Published Aug 27, 2026
·Updated
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coapdumpmsg() function when processing COAP messages containing options with zero length.
Affected Software
1 affected component
coap_dump_msg() function (COAP message processing)
Event History
Aug 27, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:17 PM
Description
Frequently Asked Questions
1
What input is required to trigger the issue?
An attacker would need to supply a COAP message containing an option with zero length that is processed by coap_dump_msg().
2
What is the likely effect of successful exploitation?
The vulnerable function can dereference a null pointer while processing the crafted message, which may cause the affected process to crash.