{"id":"CVE-2025-59391","details":"A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.","modified":"2026-08-12T15:16:54.962438Z","published":"2025-12-08T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59391.json"},"references":[{"type":"WEB","url":"https://github.com/obgm/libcoap/releases/tag/v4.3.5a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59391.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59391"},{"type":"FIX","url":"https://github.com/obgm/libcoap/pull/1730"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/obgm/libcoap","events":[{"introduced":"0"},{"fixed":"851533c3cf63d16984d370ce39d586ecb3694971"}],"database_specific":{"cpe":"cpe:2.3:a:libcoap:libcoap:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"release-4.3.5-patches"},{"fixed":"4.3.5a"}],"source":["DESCRIPTION","CPE_RANGE","REFERENCES"]}}],"versions":["v4.3.5a","v4.3.5","v4.3.5-rc3","v4.3.5-rc2","v4.3.5-rc1","v4.3.4","v4.3.3","v4.3.2","v4.3.2-rc2","v4.3.2-rc1","v4.2.1","v4.2.0","v4.2.0-rc4","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.2","v4_1_1","v4.1.1","coap-lwip"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59391.json","vanir_signatures_modified":"2026-08-12T15:16:54Z","vanir_signatures":[{"digest":{"function_hash":"85326049542284814399856562787741768727","length":1292},"id":"CVE-2025-59391-14a69ac7","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c","function":"coap_dtls_send"},"deprecated":false},{"target":{"file":"src/coap_wolfssl.c","function":"coap_tls_write"},"deprecated":false,"digest":{"function_hash":"306736978701644454561638712225277067477","length":2188},"id":"CVE-2025-59391-261a61fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_wolfssl.c"},"deprecated":false,"digest":{"line_hashes":["15411908909958860775211265335536427407","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","116849850931191068750177515966678256220","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620"],"threshold":0.9},"id":"CVE-2025-59391-33d6c428","signature_type":"Line"},{"digest":{"line_hashes":["337904441687869165843535038722711579335","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","106183898905765163754583739743222052929","170919558706517679028022730513223874599","116386489271052775311612969382955059435","282613876025531397485030245403164080916","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792"],"threshold":0.9},"id":"CVE-2025-59391-34f6744f","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"91326830784992737475680710694707116123","length":1214},"id":"CVE-2025-59391-45242826","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_gnutls.c","function":"coap_dtls_send"}},{"digest":{"function_hash":"26430849427469556451136376777718145170","length":2347},"id":"CVE-2025-59391-490458a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_wolfssl.c","function":"coap_tls_read"},"deprecated":false},{"id":"CVE-2025-59391-4cf2dc64","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_tinydtls.c"},"deprecated":false,"digest":{"line_hashes":["23031380702055205930316498110125306054","34378583416927325614830432188681466307","279146812373370674349054110943019686116","171625597872910728004536992034728778681","312943919646741470530525044446109984842","332522464106056864701340573670213419036","45989790058782624768189185181864209162","98058673563965097939786667199771668346","39696012473944314118650810272553802704","246188265563190334208842778449331505997","70970862817180733918113699814896602943","279146812373370674349054110943019686116","132753285705974266946915529153894719367","216141987605081778056913603438184117426"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"function":"coap_tls_write","file":"src/coap_gnutls.c"},"deprecated":false,"digest":{"function_hash":"292531550078019844896041999038719597629","length":1644},"id":"CVE-2025-59391-706c0010","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"21776863930825372101923181712764214740","length":1691},"id":"CVE-2025-59391-712f2490","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_gnutls.c","function":"coap_tls_read"}},{"deprecated":false,"digest":{"length":1721,"function_hash":"123123615217698491116894614054529509886"},"id":"CVE-2025-59391-8032e978","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c","function":"coap_tls_read"}},{"deprecated":false,"digest":{"function_hash":"243687100477660245376362105986385717485","length":1144},"id":"CVE-2025-59391-83b56253","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_tinydtls.c","function":"coap_dtls_receive"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_wolfssl.c","function":"coap_dtls_receive"},"deprecated":false,"digest":{"function_hash":"212547978384719786255233504667115321999","length":2908},"id":"CVE-2025-59391-92d9e275"},{"source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_tls_write"},"deprecated":false,"digest":{"function_hash":"69576481631951111685028577390359454494","length":2314},"id":"CVE-2025-59391-96c2892b","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_dtls_send"},"deprecated":false,"digest":{"length":1429,"function_hash":"33563004650523345432675580502379313629"},"id":"CVE-2025-59391-9a254090","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/coap_gnutls.c","function":"coap_dtls_receive"},"deprecated":false,"digest":{"function_hash":"62577777721189041801822773906509644626","length":2180},"id":"CVE-2025-59391-aeaf7c79","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"},{"deprecated":false,"digest":{"function_hash":"53159726183479920923849338954582782305","length":1268},"id":"CVE-2025-59391-b3cc0b6f","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_tinydtls.c","function":"coap_dtls_send"}},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_dgram_destroy"},"deprecated":false,"digest":{"function_hash":"332227376013851657869784690061081720703","length":205},"id":"CVE-2025-59391-b6e4875f","signature_type":"Function"},{"source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c"},"deprecated":false,"digest":{"line_hashes":["228786392259244641228734032934904780662","147523157495900877670261885925168230258","274004364396085238039277557504504360751","243584047675722518274780453976884872415","316713216995309952059170077154033832999","320611148643336054835590721458452056095","302011017503512693175439017717461116647","292891296865426260604046022276368703977","230625849031722816986402087332575496535","284678711105798280628671396721516681294","323488070396003554448137350098952839075","15411908909958860775211265335536427407","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","246891808803424668580015653032779311636","112987783015174694802545845404680311345","40564534837348066573672403462459524202","129737476834047468114495478589610197958","157315502960125796006743010604178644195","93273170937260253080487266157097258389","318568369596440574502441282311675373682","54887952225474782336202312518365773955","327813439605604673563040909498457788576","105168350939195450450982919117347968160","220268690295836453743650173385787328342","224345847398824450692939426554678706137","37315100012202224297509390738082288814","115133386853268709054882557872202831658","300974842540064882699480831770012553051","116849850931191068750177515966678256220","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","45119872330899513837839042929631692459","124698168619203789640236191387417845590","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856","81678169831583961286977954233385664527","313318359985536302471801617405965022092","99880862791964072525732958960222585695","22658195037501002509538246257648260479","178859116538714066501284222569954212262","309082969704580375241127243412916075620","116536891256688770484001069192968141501","134947761608587716712991501324028267856"],"threshold":0.9},"id":"CVE-2025-59391-b8eb784b","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_dtls_receive"},"deprecated":false,"digest":{"length":2651,"function_hash":"250611704829397383855490180259296588716"},"id":"CVE-2025-59391-c112c914","signature_type":"Function"},{"digest":{"function_hash":"15776374160949478909324118090219155812","length":2194},"id":"CVE-2025-59391-c34a6555","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_openssl.c","function":"coap_tls_read"},"deprecated":false},{"digest":{"function_hash":"236662025558247763740982530323169619238","length":2134},"id":"CVE-2025-59391-c3de0290","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c","function":"coap_dtls_receive"},"deprecated":false},{"digest":{"function_hash":"277881577929113743393994050608192386535","length":1069},"id":"CVE-2025-59391-d91579f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_wolfssl.c","function":"coap_dtls_send"},"deprecated":false},{"target":{"file":"src/coap_gnutls.c"},"deprecated":false,"digest":{"line_hashes":["260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792","237150004119747413224444641434797487728","26961578324912790942126112320517345898","66684850357476544012692063845321115306","145270543694757249718495051150710556030","304681457350559555706899635762218481995","110383702419857218658550560659283847622","280764313674571414571564296107986116350","260201155156599315831660544597187697792"],"threshold":0.9},"id":"CVE-2025-59391-eea6ea75","signature_type":"Line","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971"},{"id":"CVE-2025-59391-f6da2924","signature_type":"Function","signature_version":"v1","source":"https://github.com/obgm/libcoap/commit/851533c3cf63d16984d370ce39d586ecb3694971","target":{"file":"src/coap_mbedtls.c","function":"coap_tls_write"},"deprecated":false,"digest":{"function_hash":"24544517956092318288850958517713751891","length":1699}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}]}