CVE-2026-33453

camel-coap 헤더 인젝션 → RCE 취약점 재현 도구 CVE-2026-33453 이 프로젝트는 Apache Camel camel-coap 컴포넌트에서 CVE-2026-33453 으로 추적되는 Camel 메시지 헤더 인젝션 취약점을 시연합니다. 인증되지 않은 공격자가 단일 CoAP UDP 패킷을 전송하면 Exchange에 임의의 Camel 제어 헤더를 주입할 수 있으며, 라우트가 camel-exec와 같은 헤더에 민감한 프로듀서로 전달할 때 원격 코드 실행 이 가능합니다. 권고문:...

CVE-2026-18746

parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...

CVE-2026-18746: NULL Pointer Dereference

parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...

CVE-2026-18746

The Zephyr LwM2M client is vulnerable to a NULL pointer dereference in the parse_write_op() function within subsys/net/lib/lwm2m/lwm2m_message_handling.c. When the static CoAP Block1 context pool (defaulting to 3 entries) is exhausted, the init_block_ctx() function returns -ENOMEM and sets the ca...

CVE-2026-18746 NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted

parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...

CVE-2026-18416

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

CVE-2026-18416 Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

CVE-2026-18416

The Zephyr RTOS CoAP server subsystem is vulnerable to an out-of-bounds read in the match_path_uri() helper function located in subsys/net/lib/coap/coap_link_format.c. This occurs because the function compares a registered resource path against a Uri-Query href= option without properly checking t...

CVE-2026-18416 Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

CVE-2026-18416 Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

CVE-2026-18416: Out-of-bounds Read

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

CVE-2026-14368: Out-of-bounds Write

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

PT-2026-83953

The LwM2M JSON content formatter's get string in subsys/net/lib/lwm2m/lwm2m rw json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if string length buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

CVE-2026-26459

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data...

CVE-2026-26453

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coapserverhandlesession function when processing COAP messages containing URIPATH options with NULL data pointers. When the server searches for a URIPATH option matching the string "separate", ...

CVE-2026-26457

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coapdumpmsg function when processing COAP messages containing options with zero length...

CVE-2026-26452

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers...

CVE-2026-26452

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers...

PT-2026-82515

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data...

CVE-2026-26453

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coapserverhandlesession function when processing COAP messages containing URIPATH options with NULL data pointers. When the server searches for a URIPATH option matching the string "separate", ...