Medium
libcoap, libcoap2 and 1 more products — security advisory
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
- Products
- libcoap, libcoap2, libcoap3
- Affected versions
- 4.1.2-1, 4.2.0-2, 4.2.1-1, 4.2.1-1build1, 4.3.0-2, 4.3.0-2build1, 4.3.1-2, 4.3.3-1, 4.3.4-1, 4.3.4-1.1build2, 4.3.4-1.1build3, 4.3.4-1.1build4, 4.3.5-1, 4.3.5-2, 4.3.5-3, 4.3.5-4, 4.3.5-4ubuntu1
- Fixed versions
- Not specified
- CVEs
- CVE-2025-59391
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:34 UTC · Revision 1
Source evidence
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
osv:UBUNTU-CVE-2025-59391
libcoap
Fixed versions: Not specified
libcoap2
Fixed versions: Not specified
libcoap2
Fixed versions: Not specified
libcoap3
Fixed versions: Not specified
libcoap3
Fixed versions: Not specified
libcoap3
Fixed versions: Not specified
libcoap3
Fixed versions: Not specified
libcoap3
Fixed versions: Not specified
Complete source record
{
"id": "2d9d156f1dddb2a018b0f473c3dbe3dea8d4a423bb3a7dedc19003776ec4d909",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-59391",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2025-59391",
"summary": "A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.",
"evidence": "osv:UBUNTU-CVE-2025-59391",
"products": [
{
"name": {
"value": "libcoap",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.1.2-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libcoap2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.2.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "4.2.1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libcoap2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.2.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.2.1-1build1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libcoap3",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "4.3.0-2build1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libcoap3",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.1-2",
"evidence": "/affected/4/versions"
},
{
"value": "4.3.3-1",
"evidence": "/affected/4/versions"
},
{
"value": "4.3.4-1",
"evidence": "/affected/4/versions"
},
{
"value": "4.3.4-1.1build2",
"evidence": "/affected/4/versions"
},
{
"value": "4.3.4-1.1build3",
"evidence": "/affected/4/versions"
},
{
"value": "4.3.4-1.1build4",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libcoap3",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.4-1.1build4",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libcoap3",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.5-2",
"evidence": "/affected/6/versions"
},
{
"value": "4.3.5-3",
"evidence": "/affected/6/versions"
},
{
"value": "4.3.5-4",
"evidence": "/affected/6/versions"
},
{
"value": "4.3.5-4ubuntu1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libcoap3",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.4-1.1build4",
"evidence": "/affected/7/versions"
},
{
"value": "4.3.5-1",
"evidence": "/affected/7/versions"
},
{
"value": "4.3.5-2",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2025-59391",
"aliases": [
"UBUNTU-CVE-2025-59391"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap",
"purl": "pkg:deb/ubuntu/libcoap?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"4.1.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap-1-0",
"binary_version": "4.1.2-1"
},
{
"binary_name": "libcoap-1-0-bin",
"binary_version": "4.1.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap2",
"purl": "pkg:deb/ubuntu/libcoap2?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"4.2.0-2",
"4.2.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap2",
"binary_version": "4.2.1-1"
},
{
"binary_name": "libcoap2-bin",
"binary_version": "4.2.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap2",
"purl": "pkg:deb/ubuntu/libcoap2?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"4.2.1-1",
"4.2.1-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap2",
"binary_version": "4.2.1-1build1"
},
{
"binary_name": "libcoap2-bin",
"binary_version": "4.2.1-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap3",
"purl": "pkg:deb/ubuntu/libcoap3?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"4.3.0-2",
"4.3.0-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap3",
"binary_version": "4.3.0-2build1"
},
{
"binary_name": "libcoap3-bin",
"binary_version": "4.3.0-2build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap3",
"purl": "pkg:deb/ubuntu/libcoap3?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"4.3.1-2",
"4.3.3-1",
"4.3.4-1",
"4.3.4-1.1build2",
"4.3.4-1.1build3",
"4.3.4-1.1build4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap3-bin",
"binary_version": "4.3.4-1.1build4"
},
{
"binary_name": "libcoap3t64",
"binary_version": "4.3.4-1.1build4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap3",
"purl": "pkg:deb/ubuntu/libcoap3?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"4.3.4-1.1build4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap3-bin",
"binary_version": "4.3.4-1.1build4"
},
{
"binary_name": "libcoap3t64",
"binary_version": "4.3.4-1.1build4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap3",
"purl": "pkg:deb/ubuntu/libcoap3?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"4.3.5-2",
"4.3.5-3",
"4.3.5-4",
"4.3.5-4ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap3-bin",
"binary_version": "4.3.5-4ubuntu1"
},
{
"binary_name": "libcoap3t64",
"binary_version": "4.3.5-4ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libcoap3",
"purl": "pkg:deb/ubuntu/libcoap3?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"4.3.4-1.1build4",
"4.3.5-1",
"4.3.5-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-59391.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libcoap3-bin",
"binary_version": "4.3.5-2"
},
{
"binary_name": "libcoap3t64",
"binary_version": "4.3.5-2"
}
]
}
}
],
"modified": "2026-10-17T12:57:10.185820912Z",
"provider": "osv",
"upstream": [
"CVE-2025-59391"
],
"references": [
"https://ubuntu.com/security/CVE-2025-59391",
"https://www.cve.org/CVERecord?id=CVE-2025-59391",
"https://github.com/obgm/libcoap/pull/1730",
"https://github.com/obgm/libcoap/releases/tag/v4.3.5a"
]
},
"related_cves": [
{
"value": "CVE-2025-59391",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 356830,
"published_at": "2025-12-08T17:16:00+00:00"
}