EUVD-2026-67095
GHSA-vjwg-2jjg-wq8j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CoAP messages arrive over UDP without authentication, so network-vector unauthenticated DoS is correct; no confidentiality or integrity impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers.
AnalysisAI
Denial of service in ccoap's option parsing logic allows unauthenticated remote attackers to crash any service built on commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 by sending a single CoAP message carrying an invalid option number, triggering a segmentation fault. The impact is strictly availability - confidentiality and integrity are unaffected (CVSS C:N/I:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target service must be compiled against ccoap at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 or an unpatched ancestor and must expose a CoAP endpoint (UDP/5683 or DTLS/5684) reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures a remotely exploitable, zero-interaction denial-of-service - a legitimate severity for any exposed CoAP endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or tagged fix version has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all internal services and products that depend on ccoap library and document their network exposure and operational criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today