CVE-2025-65499

Published: Nov 24, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_ex_data_X509_STORE_CTX_idx() to return -1.

Affected (1)

Products: Libcoap: Libcoap

Libcoap

1 product

Libcoap

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libcoap Libcoap	Version 4.3.5

Related CWEs

CWE-129

Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References (2)

https://github.com/obgm/libcoap/issues/1747

Source: cve@mitre.org

Issue Tracking

https://github.com/obgm/libcoap/pull/1750

Source: cve@mitre.org

Issue TrackingPatch

Timeline

No history available yet.