CVE-2026-26456

Received Received - Intake

Null Pointer Dereference in ccoap Due to Race Condition

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: MITRE

Description

A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes without proper synchronization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-26456

EUVD

EUVD-2026-67097

Affected Vendors & Products

Vendor	Product	Version / Range
ipflavors	ccoap	77f55c4b466e99327c24ace8a2913d3ba7e2ccd5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a null pointer dereference vulnerability caused by a race condition in the server-side session management of ccoap. When the request dispatch thread and session cleanup thread access shared session list nodes without synchronization, one thread may dereference a session pointer while the other clears its data, causing a segmentation fault.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in the ccoap server process, particularly under concurrent request loads. Check server logs for segmentation faults or null pointer dereference errors. Use tools like gdb to attach to the running process and inspect stack traces during crashes. Enable core dumps for post-mortem analysis if the server crashes.

Impact Analysis

A remote attacker could exploit this flaw to crash the CoAP server by triggering the race condition, resulting in a denial-of-service (DoS) attack. This would make the server unavailable for legitimate users.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing the CoAP server through a null pointer dereference. It does not directly impact data confidentiality or integrity but may lead to service unavailability, which could affect compliance with regulations requiring high availability or timely data processing, such as GDPR's data protection principles or HIPAA's operational safeguards.

Mitigation Strategies

Apply a patch to the ccoap component that adds proper synchronization mechanisms (e.g., mutex locks) when accessing shared session list nodes. Alternatively, disable session management features if not required. Monitor server stability closely after changes and consider upgrading to a patched version of microcoap if available.

Hi! I’m here to help you understand CVE-2026-26456. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70