CVE-2025-34468 libcoap Stack-Based Buffer Overflow in Address Resolution DoS or Potential RCE
A stack-based buffer overflow in libcoap allows remote attackers to cause denial of service or potentially execute code when proxy logic is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-34468?
CVE-2025-34468 is a high-severity memory corruption vulnerability in libcoap, published on 31 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).
Which versions are affected by CVE-2025-34468?
It affects 1 product.
Products include Libcoap Libcoap.
How do I fix CVE-2025-34468?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-34468 being exploited?
There is no known exploitation of CVE-2025-34468 in the wild and no public exploit code.
Other vulnerabilities in libcoap
Sources
Also known as DEBIAN-CVE-2025-34468, GHSA-rj9f-6c28-qf6x, UBUNTU-CVE-2025-34468.