CVE-2026-26457: n/a

The vulnerability CVE-2026-26457 affects the ccoap component (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5). It is a null pointer dereference issue in the coap_dump_msg() function triggered by COAP messages containing options of zero length. This flaw can lead to application crashes, resulting in denial of service conditions. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can cause a denial of service by crashing the affected software due to a null pointer dereference. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider mitigating by filtering or validating COAP messages to avoid zero-length options if feasible.