CVE-2025-59391 Information disclosure in n/a

What is CVE-2025-59391?

CVE-2025-59391 is a medium-severity vulnerability in n/a, published on 8 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.

Weakness: CWE-125

Which versions are affected by CVE-2025-59391?

It affects 1 product.

Products include Libcoap Libcoap.

How do I fix CVE-2025-59391?

Upgrade to a fixed version.

Is CVE-2025-59391 being exploited?

There is no known exploitation of CVE-2025-59391 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-29013 libcoap Out-of-Bounds Read in OSCORE CBOR Unwrap Handling High 8.8
• CVE-2025-34468 libcoap Stack-Based Buffer Overflow in Address Resolution DoS or Potential RCE High 8.2
• CVE-2025-65493 Null dereference in n/a High 7.5
• CVE-2025-65494 Null dereference in n/a High 7.5
• CVE-2025-65495 Integer overflow in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-59391, GHSA-7v9m-g6fx-mq4f, UBUNTU-CVE-2025-59391.