PT-2025-54430 · Libcoap+2 · Libcoap+2

Secmate · Published 2025-01-01 · Updated 2026-02-24 · CVE-2025-34468

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libcoap versions up to and including 4.3.5

Description The software contains a stack-based buffer overflow in address resolution. This occurs when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without sufficient bounds checking. A remote attacker could potentially cause a crash and, depending on compiler settings and runtime memory protections, achieve remote code execution. Exploitation requires the proxy logic to be enabled, specifically the proxy request handling code path within an application utilizing libcoap.

Recommendations Update libcoap to a version prior to 4.3.5 that includes commit 30db3ea.

Fix

DoS

RCE

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2025-34468

Affected Products

Debian

Red Os

Libcoap

References · 17

• https://github.com/obgm/libcoap/commit/30db3ea · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-34468 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-34468 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-34468 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-34468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34468 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34468 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-34468 · Vendor Advisory
• https://github.com/obgm/libcoap/pull/1737 · Note
• https://twitter.com/CVEnew/status/2006495395891826809 · Twitter Post
• https://vulncheck.com/advisories/libcoap-stack-based-buffer-overflow-in-address-resolution-dos-or-potential-rce · Note
• https://t.me/CVEtracker/41103 · Telegram Post
• https://libcoap.net · Note
• https://t.me/msrcreports/2875 · Telegram Post
• https://t.me/msrcreports/2929 · Telegram Post