What’s Vulnerable › Vulnerabilities

CVE-2026-58465: Eclipse Wakaama CoAP Block1 Handler Unbounded Memory Allocation DoS

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-02 · updated 2026-10-25
• Weakness: CWE-770

Description

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers. Attackers can target the registration endpoint over UDP without authentication, causing the server to repeatedly reallocate a growing accumulation buffer by appending each block payload without enforcing any maximum total size limit, resulting in denial of service through memory exhaustion.

Affected products

• eclipse-wakaama wakaama: before snapshot/2026-05-26 — fixed in snapshot/2026-05-26

How to fix

Upgrade to a fixed version: eclipse-wakaama wakaama snapshot/2026-05-26. Check the vendor advisory for mitigations.

References

• https://github.com/eclipse-wakaama/wakaama/commit/a83f1ca28fa090fbc03c3669fef40daf4f89cd03
• https://github.com/eclipse-wakaama/wakaama/pull/881
• https://github.com/eclipse-wakaama/wakaama/releases/tag/snapshots%2F2026-05-26
• https://www.vulncheck.com/advisories/eclipse-wakaama-coap-block1-handler-unbounded-memory-allocation-dos

Get alerted when CVE-2026-58465 or the next vulnerability affects your stack