CVE-2026-26459

Deferred Deferred - Pending Action

Segmentation Fault in ccoap Due to Malformed COAP Messages

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: MITRE

Description

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-26459

EUVD

EUVD-2026-67099

Affected Vendors & Products

Vendor	Product	Version / Range
ipflavors	ccoap	*
songxpu	ccoap	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a segmentation fault in the ccoap library caused by improper handling of malformed COAP messages. When processing messages with insufficient option data, the coap_decode_option function allocates memory for an option list but fails to initialize it properly, leaving garbage values. If parsing fails, the function returns NULL without cleaning up the partially initialized list. The coap_clean_options function then tries to free invalid memory addresses, causing a crash.

Detection Guidance

Monitor for segmentation faults in applications using the ccoap library when processing COAP messages. Check logs for crashes in coap_decode_option or coap_clean_options functions. Use network monitoring tools to inspect malformed COAP traffic targeting ports associated with COAP services.

Impact Analysis

This vulnerability could allow an attacker to crash a system running the vulnerable ccoap library by sending specially crafted malformed COAP messages. This could lead to denial of service, disrupting services that rely on the COAP protocol for communication.

Compliance Impact

This vulnerability causes a segmentation fault due to improper memory handling in the ccoap library when processing malformed COAP messages. It does not directly relate to data privacy or security controls required by GDPR or HIPAA, which focus on unauthorized access, data breaches, or improper data handling. The issue is a denial-of-service risk through system crashes rather than compliance violations.

Mitigation Strategies

Update the ccoap library to a patched version that initializes option list data pointers to NULL and properly cleans up partially initialized options. If updating is not possible, restrict network access to COAP services or disable them until patched. Monitor systems for crashes and apply input validation for COAP messages.

Hi! I’m here to help you understand CVE-2026-26459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70