CVE-2026-58465: Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS
Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers. Attackers can target the registration endpoint over UDP without authentication, causing the server to repeatedly reallocate a growing accumulation buffer by appending each block payload without enforcing any maximum total size limit, resulting in denial of service through memory exhaustion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58465?
The severity of CVE-2026-58465 is high, rated at 7.5.
How do I fix CVE-2026-58465?
To fix CVE-2026-58465, upgrade to the latest version of Eclipse Wakaama that addresses the unbounded memory allocation vulnerability.
What type of attack does CVE-2026-58465 allow?
CVE-2026-58465 allows unauthenticated remote attackers to perform a denial-of-service attack by exhausting server memory.
Which version of Eclipse Wakaama is affected by CVE-2026-58465?
Eclipse Wakaama before the snapshot released on May 26, 2026, is affected by CVE-2026-58465.
What component of Eclipse Wakaama is vulnerable in CVE-2026-58465?
The vulnerable component in CVE-2026-58465 is the CoAP Block1 handler within the coap/block.c file.