PT-2026-33518 · Libcoap · Libcoap

Kazuma Matsumoto · Published 2026-04-17 · Updated 2026-04-21 · CVE-2026-29013

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libcoap (affected versions not specified)

Description An issue exists in the OSCORE Appendix B.2 CBOR unwrap handling where the function get byte inc() in src/oscore/oscore cbor.c relies exclusively on assert() for bounds checking. Since assert() is removed in release builds compiled with NDEBUG, attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation. This can trigger out-of-bounds reads during CBOR parsing and potentially lead to heap buffer overflow writes due to integer wraparound in the allocation size computation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-29013

OPENSUSE-SU-2026:10592-1

Affected Products

Libcoap

References · 11

• https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718 · Patch
• https://cve.org/CVERecord?id=CVE-2026-29013 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10592-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29013 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-29013 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-29013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29013 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-29013 · Vendor Advisory
• https://twitter.com/CVEnew/status/2045467381443551467 · Twitter Post
• https://suse.com/security/cve/CVE-2026-29013 · Note
• https://vulncheck.com/advisories/libcoap-out-of-bounds-read-in-oscore-cbor-unwrap-handling · Note