CVE-2026-58465 describes an unbounded memory allocation vulnerability in the CoAP Block1 handler of Eclipse Wakaama versions before snapshot/2026-05-26. The vulnerability allows unauthenticated remote attackers to send a sequence of Block1 PUT requests with incrementing block numbers to the registration endpoint over UDP. The server appends each block payload to an accumulation buffer without enforcing any maximum total size limit, causing repeated reallocations that grow unboundedly. This leads to memory exhaustion and denial of service. The vulnerability requires no authentication and has a CVSS 4.0 base score of 8.7, indicating high severity.

An unauthenticated remote attacker can cause denial of service by exhausting server memory through repeated Block1 PUT requests. This impacts availability by crashing or severely degrading the server running Eclipse Wakaama. No authentication or user interaction is required, increasing the attack surface. The vulnerability affects the CoAP Block1 handler specifically at the registration endpoint over UDP.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting exposure of the registration endpoint to untrusted networks or implementing network-level rate limiting to mitigate potential exploitation.