CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11810

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

CVE-2026-11811: Missing Release of Resource after Effective Lifetime

The UpdateHub over-the-air update client's startcoapclient in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret 0 flag, but ret was set to -1 immediately after the socket was...

CVE-2026-11810: NULL Pointer Dereference

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...

PT-2026-69997

Name of the Vulnerable Software and Affected Versions UpdateHub affected versions not specified Description The over-the-air update client contains a resource leak in the start coap client function within subsys/mgmt/updatehub/updatehub.c. When a connection to the UpdateHub server fails during...

EUVD-2026-54221

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-5855: Out-of-bounds Read

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

Exploit for Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Camel

camel-coap Header Injection → RCE Vulnerability Reproducer CV...

CVE-2026-58465

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers...

CVE-2026-58465 Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers...

CVE-2026-58465 Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers...

CVE-2026-58465

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers...

CVE-2026-58465

The CVE affects Eclipse Wakaama before snapshot/2026-05-26, with an unbounded memory allocation in the CoAP Block1 handler (coap/block.c). Unauthenticated remote attackers can exhaust memory by sending a sequence of Block1 PUT requests with incrementing block numbers to the registration endpoint ...

PT-2026-55282

Name of the Vulnerable Software and Affected Versions Eclipse Wakaama versions prior to snapshot/2026-05-26 Description An unbounded memory allocation issue exists in the CoAP Block1 handler within the coap/block.c file. Unauthenticated remote attackers can cause a denial of service by sending a...

CVE-2026-58465: Allocation of Resources Without Limits or Throttling

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers...

OSV-2026-762 Heap-buffer-overflow in coap_pdu_parse_header

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=513783540 Crash type: Heap-buffer-overflow READ 1 Crash state: coappduparseheader coappduparse2 coappduparse...