CVE-2025-65496
BaseFortify
Publication date: 2025-11-24
Last updated on: 2025-12-01
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libcoap | libcoap | 4.3.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a NULL pointer dereference in the function coap_dtls_generate_cookie() within the src/coap_openssl.c file of the libcoap 4.3.5 library. It occurs when a crafted DTLS handshake causes the OpenSSL function SSL_get_SSL_CTX() to return NULL, which is not properly checked before use. This leads to a NULL pointer dereference, causing the application to crash and resulting in a denial of service.
How can this vulnerability impact me? :
The vulnerability can be exploited remotely by an attacker sending a specially crafted DTLS handshake message. This triggers a NULL pointer dereference in libcoap, causing the application to crash and resulting in a denial of service. This means that services relying on libcoap for DTLS communication could become unavailable or unstable under attack.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for crashes or segmentation faults in applications using libcoap 4.3.5 during DTLS handshakes, especially those involving OpenSSL. Since the issue occurs due to a NULL pointer dereference triggered by a crafted DTLS handshake, network detection could involve capturing and analyzing DTLS handshake packets for anomalies or malformed requests targeting libcoap services. However, no specific detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating libcoap to a version that includes the patch from pull request #1750, which adds necessary return value checks to prevent NULL pointer dereferences. If updating is not immediately possible, consider restricting or filtering DTLS handshake traffic to the affected services to reduce exposure to crafted handshake attempts that trigger the vulnerability. [2]