CVE-2026-29013

NameCVE-2026-29013
Descriptionlibcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause heap buffer overflow writes through integer wraparound in allocation size computation.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1134340

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libcoap3 (PTS)bookworm4.3.1-1vulnerable
trixie4.3.4-1.1+deb13u2vulnerable
forky, sid4.3.5-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libcoap3source(unstable)(unfixed)1134340

Notes

Fixed by: https://github.com/obgm/libcoap/commit/b7847c4dbb0dbee7c90b09a673d4cae256f03718 (v4.3.5b)

Search for package or bug name: Reporting problems