CVE-2025-65501
📋 TL;DR
A null pointer dereference vulnerability in libcoap's DTLS handshake processing allows remote attackers to crash applications using the library. This affects systems running libcoap 4.3.5 with DTLS enabled, primarily IoT devices and network services using CoAP protocol.
💻 Affected Systems
- libcoap (OISM CoAP library)
📦 What is this software?
Libcoap by Libcoap
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service causing application crash and service disruption
Likely Case
Service interruption requiring restart of affected application
If Mitigated
No impact if DTLS is disabled or proper null checks are implemented
🎯 Exploit Status
Exploitation requires sending a DTLS handshake that triggers the null pointer condition
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.6 or later
Vendor Advisory: https://github.com/obgm/libcoap/issues/1748
Restart Required: Yes
Instructions:
1. Update libcoap to version 4.3.6 or later. 2. Recompile applications using libcoap. 3. Restart affected services.
🔧 Temporary Workarounds
Disable DTLS
allDisable DTLS functionality if not required
Configure application to use CoAP without DTLS
Apply patch manually
linuxApply the fix from GitHub pull request #1750
git apply patch-from-pr1750.diff
🧯 If You Can't Patch
- Implement network segmentation to isolate CoAP services
- Use rate limiting on DTLS handshake attempts
🔍 How to Verify
Check if Vulnerable:
Check libcoap version: dpkg -l | grep libcoap or check installed package versionCheck Version:
pkg-config --modversion libcoap-3Verify Fix Applied:
Verify version is 4.3.6 or later and check that coap_dtls_info_callback includes null pointer check📡 Detection & Monitoring
Log Indicators:
- Application crash logs mentioning libcoap
- Segmentation fault in coap_dtls_info_callback
Network Indicators:
- Multiple DTLS handshake attempts followed by service unavailability
SIEM Query:
source="application.logs" AND "segmentation fault" AND "libcoap"