Dashboard / CVE-2025-34468

CVE-2025-34468

HIGH
MEDIUM Priority: 0.06 BB Relevance: 77/100
Published: 2025-12-31 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: Present
VC: None
VI: None
VA: High

Description

libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
libcoap libcoap 0

References & Advisories (4)

Bug Bounty Relevance

77 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.75%
Raw Score 0.007480
Percentile 55.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00748
2026-11-12
0.00748
2026-11-10
0.00748
2026-11-09
0.00748
2026-11-08
0.00748

Intelligence Sources

mitre ref →

External Links