CVE-2026-29013 libcoap Out-of-Bounds Read in OSCORE CBOR Unwrap Handling

What is CVE-2026-29013?

CVE-2026-29013 is a high-severity memory corruption vulnerability in libcoap, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() for bounds checking, which is removed in release builds compiled with NDEBUG. Attackers can send crafted CoAP requests with malformed OSCORE options or responses during OSCORE negotiation to trigger out-of-bounds reads during CBOR parsing and potentially cause out-of-bounds reads through integer wraparound in allocation size computation.

Weakness: CWE-125

Which versions are affected by CVE-2026-29013?

It affects 1 product.

Products include Libcoap Libcoap.

How do I fix CVE-2026-29013?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-29013 being exploited?

There is no known exploitation of CVE-2026-29013 in the wild and no public exploit code.

Other vulnerabilities in libcoap

• CVE-2025-34468 libcoap Stack-Based Buffer Overflow in Address Resolution DoS or Potential RCE High 8.2
• CVE-2025-65493 Null dereference in n/a High 7.5
• CVE-2025-65494 Null dereference in n/a High 7.5
• CVE-2025-65495 Integer overflow in n/a High 7.5
• CVE-2023-30362 Information disclosure in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-29013, GHSA-4vrr-6f8v-98rf, UBUNTU-CVE-2026-29013, openSUSE-SU-2026:10592-1.