CVE-2025-59391
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap...
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Record
CVE-2025-59391- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2025-201786
6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Record
EUVD-2025-201786- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7v9m-g6fx-mq4f
6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap...
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Record
GHSA-7v9m-g6fx-mq4f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Record
CVE-2025-59391- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Record
CVE-2025-59391- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-59391
6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Record
DEBIAN-CVE-2025-59391- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-59391
6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Record
UBUNTU-CVE-2025-59391- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcoap3Debian:12 |
All versions, plus listed versions 4.3.1-14.3.1-24.3.3-14.3.4-14.3.4-1.1 Show 5 moreShow less4.3.4-1.1~exp14.3.5-14.3.5-24.3.5-34.3.5-4 |
None known |
libcoap3Debian:13 |
before 4.3.4-1.1+deb13u2, plus listed versions 4.3.4-1.14.3.4-1.1+deb13u1 |
4.3.4-1.1+deb13u2 |
libcoap3Debian:14 |
before 4.3.5-2, plus listed versions 4.3.4-1.14.3.5-1 |
4.3.5-2 |
libcoapUbuntu:18.04:LTS |
All versions, plus listed versions 4.1.2-1 |
None known |
libcoap2Ubuntu:20.04:LTS |
All versions, plus listed versions 4.2.0-24.2.1-1 |
None known |
libcoap2Ubuntu:22.04:LTS |
All versions, plus listed versions 4.2.1-14.2.1-1build1 |
None known |
libcoap3Ubuntu:22.04:LTS |
All versions, plus listed versions 4.3.0-24.3.0-2build1 |
None known |
libcoap3Ubuntu:24.04:LTS |
All versions, plus listed versions 4.3.1-24.3.3-14.3.4-14.3.4-1.1build24.3.4-1.1build34.3.4-1.1build4 |
None known |
libcoap3Ubuntu:25.10 |
All versions, plus listed versions 4.3.4-1.1build4 |
None known |
libcoap3Ubuntu:26.10 |
All versions, plus listed versions 4.3.5-24.3.5-34.3.5-44.3.5-4ubuntu1 |
None known |
libcoap3Ubuntu:26.04:LTS |
All versions, plus listed versions 4.3.4-1.1build44.3.5-14.3.5-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59391 is a medium vulnerability (CVSS 6.5) in Libcoap, published December 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in libcoap3 4.3.4-1.1+deb13u2.
References
github.com/obgm/libcoap/releases/tag/v4.3.5a
github.com/obgm/libcoap/pull/1730
nvd.nist.gov/vuln/detail/CVE-2025-59391
github.com/advisories/GHSA-7v9m-g6fx-mq4f
github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59391.json
security-tracker.debian.org/tracker/CVE-2025-59391
ubuntu.com/security/CVE-2025-59391
cve.org/CVERecord?id=CVE-2025-59391