EUVD-2026-41417
GHSA-95xc-mgc7-g4jq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity UDP attack with no user interaction; impact is availability-only memory exhaustion, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers. Attackers can target the registration endpoint over UDP without authentication, causing the server to repeatedly reallocate a growing accumulation buffer by appending each block payload without enforcing any maximum total size limit, resulting in denial of service through memory exhaustion.
AnalysisAI
Memory-exhaustion denial of service in Eclipse Wakaama (an OMA LwM2M client/server library) before snapshot 2026-05-26 allows unauthenticated remote attackers to crash the server by streaming CoAP Block1 PUT requests. The CoAP Block1 handler in coap/block.c appends each incoming block to a reassembly buffer without capping total size, so an attacker reaching the UDP registration endpoint can force unbounded reallocation until memory is exhausted. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
Wakaama is a C implementation of the OMA Lightweight M2M (LwM2M) protocol, which runs over CoAP (RFC 7252) on UDP and is used for managing constrained IoT devices. CoAP's Block1 option (RFC 7959) fragments large request payloads into a sequence of numbered blocks that the receiver reassembles. The affected code path is the Block1 reassembly logic in coap/block.c, which grows an accumulation buffer by appending each block's payload as blocks arrive with incrementing block numbers. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling): the handler enforces no maximum total reassembled size, so the buffer can be driven arbitrarily large. The single affected product per CPE is cpe:2.3:a:eclipse-wakaama:wakaama:*, i.e. all versions prior to the 2026-05-26 snapshot.
RemediationAI
Vendor-released patch: upgrade to the Eclipse Wakaama snapshot/2026-05-26 release (https://github.com/eclipse-wakaama/wakaama/releases/tag/snapshots%2F2026-05-26), which incorporates the fix from commit a83f1ca28fa090fbc03c3669fef40daf4f89cd03 and PR #881 (https://github.com/eclipse-wakaama/wakaama/pull/881); because Wakaama is typically embedded as a library, rebuild and redeploy affected firmware/servers against the patched source. Where immediate upgrade is not feasible, apply compensating controls: restrict UDP access to the CoAP/LwM2M registration endpoint (default CoAP port 5683, or 5684 for CoAPS) to known device network ranges via firewall or network segmentation so arbitrary internet hosts cannot reach it (trade-off: breaks onboarding of devices from unlisted networks); require DTLS-secured registration and reject unauthenticated CoAP where the deployment allows it (trade-off: adds handshake overhead on constrained devices and requires PSK/cert provisioning); and monitor per-source memory growth or apply a downstream size/rate limit on Block1 request sequences. See the VulnCheck advisory (https://www.vulncheck.com/advisories/eclipse-wakaama-coap-block1-handler-unbounded-memory-allocation-dos) for details.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today