CVE-2025-34468: libcoap Stack-Based Buffer Overflow in Hostname Address Resolution

CVE-2025-34468 is a critical stack-based buffer overflow in libcoap, the widely embedded open-source C library implementing the CoAP (Constrained Application Protocol) used by many IoT and firmware CoAP clients and servers: when an application built with libcoap's proxy logic enabled resolves an attacker-supplied hostname longer than 255 bytes, the hostname is copied into a fixed 256-byte stack buffer without a length check, letting a remote, unauthenticated attacker crash the process and potentially achieve remote code execution depending on the target's compiler hardening and memory protections; NVD has published its own Primary CVSS v3.1 score of 9.8 (critical) for the flaw.

CVE-2025-34468 (CWE-121, stack-based buffer overflow; also tagged CWE-787, out-of-bounds write) affects libcoap, the obgm/libcoap open-source C implementation of the IETF's CoAP protocol (RFC 7252) that ships inside many resource-constrained IoT and embedded devices using CoAP for machine-to-machine messaging. NVD's description states: "libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap)" (NVD).

NVD lists the CVE's status as "Analyzed" with its own Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; VulnCheck, which disclosed the issue, separately scores it 8.2 under CVSS v4.0 as a Secondary rating, reflecting that exploitation needs the proxy code path to be reachable (NVD, VulnCheck advisory).

The upstream fix, commit 30db3ea in the obgm/libcoap repository, is titled "coap_address.c: Validate length of provided host name" and states plainly: "Host names larger than 255 bytes will cause an internal buffer overflow. Hostnames provided to coap_resolve_address_info() now have their length validated," adding that the flaw was "Discovered by SecMate (https://secmate.dev)" and that coap_split_uri() now sanity-checks host lengths when parsing a CoAP URI (libcoap commit 30db3ea). The fix was tracked upstream via pull request #1737.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00748 (55.065th percentile) as of 2026-11-06 — a critical, NVD-confirmed library flaw with no reported in-the-wild exploitation to date (CISA KEV, FIRST EPSS).

Any firmware or embedded application that links libcoap 4.3.5 or earlier and enables its proxy request-handling functionality should upgrade to a version that includes commit 30db3ea, and should treat CoAP proxy endpoints reachable from untrusted networks as a priority for patching.

• libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution: attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without bounds checking, enabling a crash or potential RCE when the proxy request-handling code path is enabled. — NVD
• NVD status 'Analyzed'; NVD Primary CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; VulnCheck's Secondary CVSS v4.0 score is 8.2. — NVD
• Fix commit 30db3ea validates hostname length in coap_address.c and coap_uri.c; hostnames longer than 255 bytes previously caused an internal buffer overflow in coap_resolve_address_info(); discovered by SecMate. — libcoap GitHub commit 30db3eaa1f0464722ebea2ca2d5084aebfbd344d
• VulnCheck rates the flaw 'High' severity, CWE-121 (stack-based buffer overflow), credits SecMate, and confirms exploitation requires the proxy request-handling path. — VulnCheck advisory
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00748 (55.065th percentile) as of 2026-11-06. — FIRST EPSS