CVE-2025-65493: 
NixOS vulnerability analysis and mitigation

CVE-2025-65493 is a NULL pointer dereference vulnerability in OISM libcoap 4.3.5 that allows remote attackers to cause a denial of service (DoS) by sending a crafted DTLS/TLS connection that triggers BIO_get_data() to return NULL. The flaw resides in src/coap_openssl.c and was reported on September 19, 2025, with the CVE published on November 24, 2025. It affects libcoap version 4.3.5 and was fixed in version 4.3.5a. The CVSS v3.1 base score is 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing NULL return value check for BIO_get_data() in two functions within src/coap_openssl.c (CWE-476: NULL Pointer Dereference). Specifically, coap_dgram_write() at line 624 and coap_dgram_ctrl() at line 656 both call BIO_get_data() and immediately dereference the returned pointer without verifying it is non-NULL. When a crafted DTLS/TLS connection causes BIO_get_data() to return NULL — due to memory corruption, improper BIO initialization, or other system-level conditions — the subsequent dereference of data->session triggers a segmentation fault. The fix, merged in pull request #1750, adds NULL checks consistent with other locations in the codebase where BIO_get_data() is already guarded (GitHub Issue #1743, GitHub PR #1750).

Successful exploitation causes a crash (segmentation fault) of the libcoap process, resulting in a complete denial of service for any application relying on the library for CoAP-over-DTLS/TLS communication. Because the attack requires no authentication and no user interaction, a remote attacker can repeatedly crash the service, making it persistently unavailable. There is no known confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-65493. The EPSS score is approximately 0.139%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 276682) and Qualys (detection ID 287852) (Feedly, Tenable).

1. Reconnaissance: Identify network-accessible services using libcoap 4.3.5 with OpenSSL-backed DTLS/TLS support (e.g., CoAP servers on UDP port 5684 or TCP port 5684).
2. Craft malicious connection: Initiate a DTLS or TLS handshake to the target CoAP endpoint using a crafted or malformed connection sequence designed to trigger an abnormal BIO initialization state.
3. Trigger NULL return: Manipulate the connection in a way that causes the internal OpenSSL BIO object's data pointer to be unset or cleared, so that BIO_get_data() returns NULL during a subsequent write or control operation.
4. Cause crash: When libcoap's coap_dgram_write() or coap_dgram_ctrl() dereferences the NULL pointer returned by BIO_get_data(), the process crashes with a segmentation fault, achieving denial of service (GitHub Issue #1743).

• Logs: Application or system logs showing segmentation fault (SIGSEGV) or crash of the libcoap-based service process; coredump files generated by the CoAP server process.
• Network: Repeated or anomalous DTLS/TLS connection attempts to CoAP endpoints (UDP/TCP port 5684) from unexpected source IPs, particularly connections that do not complete a normal handshake.
• Process: Unexpected termination or restart of the CoAP server process; watchdog or supervisor logs indicating repeated process restarts.

The vulnerability is fixed in libcoap version 4.3.5a, released via the patch merged in GitHub PR #1750 on September 22, 2025. Users should upgrade to 4.3.5a or later immediately. Linux distributions including openSUSE Tumbleweed and Fedora have issued updated packages. No configuration-based workaround is available; upgrading is the only reliable remediation. As a temporary measure, restricting network access to CoAP DTLS/TLS endpoints via firewall rules can reduce exposure (GitHub PR #1750, Red Hat Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2416771) and published a security advisory. The libcoap maintainer (mrdeep1) promptly addressed the issue alongside several related NULL-check deficiencies (CVE-2025-65493 through CVE-2025-65501) in a single pull request merged on September 22, 2025. openSUSE and Fedora issued updated packages shortly after the CVE was published. No significant broader media coverage or social media discussion has been observed (Red Hat Bugzilla, GitHub PR #1750).