CVE-2026-26459: n/a

CVE-2026-26459 describes a vulnerability in the ccoap component (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) where the option parsing logic fails to properly handle malformed COAP messages that contain insufficient option data. This improper handling results in a segmentation fault, causing the application to crash. The vulnerability is categorized under CWE-787, indicating an out-of-bounds write or memory corruption issue. The CVSS v3.1 base score is 7.5, reflecting a high severity due to the network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability (denial of service). There is no information on affected versions or available patches, and no known exploits in the wild have been reported.

The vulnerability can cause a denial of service by crashing the affected application when it processes malformed COAP messages with insufficient option data. There is no reported impact on confidentiality or integrity. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level filtering to block malformed COAP messages if feasible. Monitor for vendor updates regarding patches or official mitigations.