{"id":"CVE-2026-23749","summary":"Golioth Firmware SDK \u003c 0.22.0 Blockwise Transfer Path Out-of-Bounds Read","details":"Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx-\u003epath unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).","modified":"2026-08-12T16:24:51.734239Z","published":"2026-02-26T17:32:30.795Z","database_specific":{"cwe_ids":["CWE-170"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23749.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23749.json"},{"type":"ADVISORY","url":"https://github.com/golioth/golioth-firmware-sdk/releases/tag/v0.22.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23749"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/golioth-firmware-sdk-blockwise-transfer-path-out-of-bounds-read"},{"type":"FIX","url":"https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d"},{"type":"PACKAGE","url":"https://github.com/golioth/golioth-firmware-sdk"},{"type":"ARTICLE","url":"https://secmate.dev/disclosures/SECMATE-2025-0017"},{"type":"EVIDENCE","url":"https://blog.secmate.dev/posts/golioth-vulnerabilities-disclosure/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/golioth/golioth-firmware-sdk","events":[{"introduced":"22483586e6d5beedbd678015daa3dbbb4e5e6fb1"},{"fixed":"0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d"},{"fixed":"f15281671a9dd5c14a5215021f4469a8e3071b37"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0.19.1"},{"fixed":"0.22.0"}]}}],"versions":["v0.20.0","v0.21.1","v0.21.0","v0.19.1"],"database_specific":{"vanir_signatures_modified":"2026-08-12T16:24:51Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d","target":{"file":"src/coap_blockwise.c"},"deprecated":false,"digest":{"line_hashes":["56502345576676756675422024377567781483","205479671246672318692771008585564255481","252508625059605475129627471649153268843","185808600035126455037782035841831069175"],"threshold":0.9},"id":"CVE-2026-23749-b02f7d91","signature_type":"Line"},{"source":"https://github.com/golioth/golioth-firmware-sdk/commit/0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d","target":{"function":"blockwise_transfer_init","file":"src/coap_blockwise.c"},"deprecated":false,"digest":{"function_hash":"63305777133134424483942790192886599276","length":389},"id":"CVE-2026-23749-bd8149f7","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23749.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}