CVE-2025-65500: Libcoap NULL Pointer Dereference DOS

CVE-2025-65500 Overview

CVE-2025-65500 is a NULL pointer dereference vulnerability in the coap_dtls_generate_cookie() function located in src/coap_openssl.c within OISM libcoap 4.3.5. The flaw allows remote attackers to trigger a denial of service by sending a crafted Datagram Transport Layer Security (DTLS) handshake. The malformed handshake causes SSL_get_SSL_CTX() to return NULL, which is then dereferenced without validation. The vulnerability is tracked under [CWE-476] and affects Constrained Application Protocol (CoAP) deployments that use the OpenSSL backend for DTLS.

Critical Impact
Remote attackers can crash libcoap-based CoAP servers and clients by sending a crafted DTLS handshake, disrupting Internet of Things (IoT) communications relying on the affected library.

Affected Products

libcoap 4.3.5 (OISM libcoap distribution)
CoAP applications using the coap_openssl.c DTLS backend
IoT devices and gateways embedding vulnerable libcoap builds

Discovery Timeline

2025-11-24 - CVE-2025-65500 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65500

Vulnerability Analysis

The vulnerability resides in the DTLS cookie generation routine coap_dtls_generate_cookie() in src/coap_openssl.c. This function is invoked during the DTLS handshake to produce a stateless cookie used for HelloVerifyRequest exchanges. The routine calls SSL_get_SSL_CTX() to retrieve the OpenSSL SSL context associated with the current session. Under specific crafted handshake conditions, SSL_get_SSL_CTX() returns a NULL pointer. The function subsequently dereferences this pointer without a null check, causing the process to crash.

Exploitation requires no authentication or privileges. An attacker only needs network access to the CoAP endpoint and the ability to initiate a DTLS handshake. The impact is limited to availability, as the crash terminates the CoAP service without exposing memory contents or allowing code execution.

Root Cause

The root cause is missing validation of the return value from SSL_get_SSL_CTX(). The function assumes the returned SSL context pointer is always valid, violating defensive programming practices for external library calls. When a malformed DTLS ClientHello or specific handshake state causes OpenSSL to return NULL, the subsequent pointer dereference triggers a segmentation fault. Details are documented in libcoap GitHub Issue #1746.

Attack Vector

The attack vector is network-based over User Datagram Protocol (UDP), the transport used by CoAP and DTLS. An attacker sends a crafted DTLS handshake message to the vulnerable CoAP server or client on the DTLS port, typically UDP 5684. The malformed handshake places the OpenSSL session in a state where SSL_get_SSL_CTX() returns NULL. When the libcoap cookie generation routine executes, the NULL dereference crashes the process. Repeated exploitation prevents service recovery for devices that do not auto-restart.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in the upstream fix at libcoap Pull Request #1750.

Detection Methods for CVE-2025-65500

Indicators of Compromise

Unexpected termination or segmentation faults of libcoap-based processes shortly after inbound DTLS traffic on UDP 5684
Core dumps referencing coap_dtls_generate_cookie or SSL_get_SSL_CTX in the stack trace
Repeated inbound DTLS ClientHello packets from a single source followed by service restarts
Increased CoAP client reconnection attempts due to server unavailability

Detection Strategies

Monitor CoAP service uptime and correlate crashes with inbound DTLS handshake traffic using host-based logging
Inspect DTLS traffic patterns for malformed or repeated ClientHello messages targeting UDP 5684
Deploy application-layer intrusion detection signatures for anomalous DTLS handshake sequences
Audit deployed libcoap versions across IoT fleets to identify the vulnerable 4.3.5 release

Monitoring Recommendations

Enable verbose libcoap logging to capture handshake failures and abnormal termination events
Aggregate CoAP daemon crash logs into a centralized logging platform for correlation and alerting
Track process restart counts on IoT gateways running libcoap and alert on thresholds
Baseline normal DTLS handshake rates per source address and alert on deviations

How to Mitigate CVE-2025-65500

Immediate Actions Required

Identify all systems running libcoap 4.3.5 with the OpenSSL DTLS backend
Apply the upstream fix from libcoap Pull Request #1750 or upgrade to a patched release
Restrict inbound UDP 5684 traffic to trusted CoAP peers using firewall rules or access control lists
Configure automatic service restart for libcoap-based daemons to reduce downtime from crash exploitation

Patch Information

The libcoap maintainers addressed the NULL pointer dereference in Pull Request #1750. The patch adds validation of the pointer returned by SSL_get_SSL_CTX() in coap_dtls_generate_cookie() and returns an error instead of dereferencing NULL. Consumers should rebuild libcoap from a source tree containing the fix or update to a downstream distribution package incorporating the patch.

Workarounds

Restrict access to the CoAP DTLS port (UDP 5684) at the network perimeter to trusted client addresses
Disable DTLS on CoAP services where secure transport is not required and alternative security controls exist
Deploy a rate-limiting proxy in front of libcoap endpoints to blunt repeated handshake abuse
Enable process supervision (for example systemd restart policies) to automatically recover crashed services

bash

# Example: rebuild libcoap from source with the upstream fix applied
git clone https://github.com/obgm/libcoap.git
cd libcoap
git fetch origin pull/1750/head:fix-cve-2025-65500
git checkout fix-cve-2025-65500
./autogen.sh
./configure --with-openssl
make && sudo make install

# Example: restrict inbound CoAP DTLS traffic with iptables
sudo iptables -A INPUT -p udp --dport 5684 -s 203.0.113.0/24 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 5684 -j DROP