CVE-2026-29013: libcoap Out-of-Bounds Read in OSCORE CBOR Unwrap Handling
libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where getbyteinc() in src/oscore/oscorecbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29013?
CVE-2026-29013 is classified as a medium severity vulnerability due to potential information leakage risks.
How do I fix CVE-2026-29013?
To fix CVE-2026-29013, update to the latest version of libcoap that includes patches addressing this vulnerability.
What causes the CVE-2026-29013 vulnerability?
CVE-2026-29013 is caused by an out-of-bounds read issue in the OSCORE CBOR unwrap handling due to insufficient bounds checking.
Which versions of libcoap are affected by CVE-2026-29013?
CVE-2026-29013 affects all versions of libcoap that utilize the flawed OSCORE CBOR unwrap handling implementation.
Is CVE-2026-29013 exploitable in the wild?
While there are no reports of active exploitation of CVE-2026-29013, the out-of-bounds read could potentially be leveraged in specific attack scenarios.