CVE-2025-34468: 
NixOS vulnerability analysis and mitigation

CVE-2025-34468 is a stack-based buffer overflow vulnerability in libcoap's address resolution logic, classified as CWE-121/CWE-787. It affects libcoap versions up to and including 4.3.5, prior to commit 30db3ea, and was disclosed on December 31, 2025. The flaw was discovered by SecMate and reported via VulnCheck as the CNA. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.2 (High) (VulnCheck Advisory, Red Hat).

The vulnerability exists in coap_resolve_address_info() within src/coap_address.c, where attacker-controlled hostname data is copied via memcpy() into a fixed 256-byte stack buffer (addrstr) without first validating the length of the input. When a hostname exceeding 255 bytes is supplied, the copy operation overflows the stack buffer, potentially overwriting adjacent stack memory including return addresses or saved registers. Exploitation requires that the proxy logic be enabled in the application using libcoap — specifically, the proxy request handling code path must be active. The fix, introduced in commit 30db3ea (merged September 12, 2025, released as v4.3.5a), adds a length check before the memcpy call and also validates hostname length during URI parsing in coap_split_uri() (GitHub PR #1737, GitHub Commit).

Successful exploitation can result in a crash (denial of service) or, depending on compiler mitigations and runtime memory protections (e.g., stack canaries, ASLR, NX), potentially remote code execution without authentication. The CVSS v3.1 score reflects high confidentiality, integrity, and availability impacts. Because libcoap is widely used in IoT and embedded CoAP protocol implementations, vulnerable deployments with proxy functionality enabled could expose critical infrastructure or constrained devices to full compromise (VulnCheck Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.0033 (0.33%), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target application to have proxy logic enabled, which reduces the overall attack surface compared to a universally exploitable flaw (VulnCheck Advisory, Feedly).

1. Reconnaissance: Identify network-accessible services using libcoap versions ≤ 4.3.5 with proxy functionality enabled (e.g., CoAP proxy servers, IoT gateways). Tools like Shodan or Censys can be used to locate CoAP services (default UDP port 5683 or TCP for reliable transports).
2. Craft malicious CoAP proxy request: Construct a CoAP request that includes a proxy URI option (Proxy-Uri) containing a hostname component exceeding 255 bytes in length.
3. Send the request: Transmit the crafted CoAP packet to the target service. No authentication is required. The oversized hostname is passed to coap_resolve_address_info() via the proxy handling code path.
4. Trigger buffer overflow: The memcpy() call in coap_resolve_address_info() copies the oversized hostname into the 256-byte addrstr stack buffer without bounds checking, overflowing the stack.
5. Achieve denial of service or RCE: Depending on the presence or absence of stack canaries, ASLR, and NX protections, the overflow either crashes the process (DoS) or, with a carefully crafted payload, overwrites the return address to redirect execution to attacker-controlled code (GitHub Commit, VulnCheck Advisory).

• Network: Unexpected CoAP proxy requests (UDP/5683 or TCP) containing Proxy-Uri options with hostnames exceeding 255 bytes; anomalous outbound connections from CoAP service processes to unknown external hosts.
• Logs: Application logs showing warnings such as Host name too long (> 255) from libcoap (introduced in the patched version); crash reports or core dumps from the CoAP service process; repeated connection attempts from a single source IP with malformed URIs.
• Process: Unexpected child processes spawned by the CoAP service (e.g., shell processes); process crashes or restarts of the libcoap-based service; unusual memory access violations in service logs.
• File System: Unexpected files written by the CoAP service process (e.g., web shells, reverse shell scripts) if RCE is achieved; new cron jobs or startup scripts created under the service account.

The vulnerability is fixed in libcoap commit 30db3ea, released as version v4.3.5a (merged September 12, 2025). Users should update to v4.3.5a or any later version that includes this commit. As an immediate workaround for applications that cannot be patched promptly, disable proxy logic/functionality in the libcoap-based application if it is not required. Additionally, implement network-level controls (e.g., firewall rules) to restrict which sources can send proxy requests to the CoAP service (GitHub PR #1737, VulnCheck Advisory).

The vulnerability was discovered by SecMate (https://secmate.dev) and reported through VulnCheck, which served as the CNA for this CVE. Red Hat tracked the issue via Bugzilla (Bug 2426524) and rated it high severity. Coverage appeared in security aggregators including The Hacker News weekly recap and various CVE feed services shortly after disclosure. No significant researcher controversy or widespread social media discussion has been observed beyond standard CVE tracking (Red Hat Bugzilla, The Hacker News).