Description
The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing it against the option length len. When a registered path segment is longer than the supplied URI and the URI is a prefix of it, the loop reads uri[len] and beyond, past the end of the option value.

The path is reached from coap_well_known_core_get_len() and coap_well_known_core_get() via match_queries_resource(), i.e. by any unauthenticated GET /.well-known/core?href=/<prefix> request to a device that serves /.well-known/core (for the CoAP server subsystem, CONFIG_COAP_SERVER_WELL_KNOWN_CORE, default y) and has at least one resource that declares struct coap_core_metadata attributes.

The over-read does not reach the receive buffer. The well-known-core builders parse the query into a stack-local struct coap_option, whose value is a fixed array (value[12], or CONFIG_COAP_EXTENDED_OPTIONS_LEN_VALUE bytes) that the option bytes are copied into, so uri points into that copy. Reading past len therefore reads the unused, uninitialized tail of the array and, when the option fills it, the bytes just past it in the same stack frame. (In the ZoAP library of v1.8.0 to v1.9.x the option value was instead a pointer into the received packet, and the over-read ran past the option inside the packet buffer.)

The impact is bounded. The number of bytes read past the end is limited by the length of the resource path segment, and each additional byte is only read if it happens to equal the next path character, so in practice the over-read is one byte. It also cannot influence the response: returning a match requires the final compared index to be len - 1 or len, both in bounds, so out-of-bounds bytes only ever steer the loop to the next candidate resource. The consequence is undefined behaviour, not information disclosure and not a matching error.

The fix adds a k >= len guard at the top of the inner loop, so every uri[k] dereference is within the option value while still allowing a trailing * wildcard to match a longer path.
Published: 2026-09-28
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Limited Out-of-Bounds Read
Action: Apply Latest Patch
AI Analysis

Impact

The CoAP link-format helper function match_path_uri() in Zephyr's CoAP subsystem compares a registered resource path with a URI supplied in a Uri-Query href= option. It fails to enforce that the comparison index remains within the bounds of the option length, causing an out‑of‑bounds read of the option buffer. The over‑read is bounded by the length of the candidate resource segment and typically results in reading only one byte beyond the end. This leads to undefined behaviour but does not expose data or alter the response; the read occurs solely within a stack‑local option value that is copied from the received packet.

Affected Systems

Zephyr Project RTOS (zephyrproject:zephyr) builds that enable CONFIG_COAP_SERVER_WELL_KNOWN_CORE and expose /.well-known/core with at least one resource having coap_core_metadata. All releases prior to the patch commit ef5b303dc88fb5159850623a2b51b590c36fa5bc are susceptible.

Risk and Exploitability

The CVSS score of 3.7 classifies the vulnerability as low severity. The EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. An attacker can trigger the out‑of‑bounds read by sending an unauthenticated GET /.well‑known/core?href=/<prefix> request. The resulting undefined behaviour is limited to potential logic inconsistency or application instability; no information disclosure or remote code execution is described.

Generated by OpenCVE AI on September 28, 2026 at 22:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Zephyr update that includes commit ef5b303dc88fb5159850623a2b51b590c36fa5bc, which adds a bounds guard to the match_path_uri loop.
  • If the device cannot be updated, disable CONFIG_COAP_SERVER_WELL_KNOWN_CORE to prevent execution of the vulnerable code path.
  • For devices that must retain the feature but cannot apply the patch, consider using compiler options that initialize stack buffers to zero, which may mitigate the undefined behaviour caused by the over‑read.

Generated by OpenCVE AI on September 28, 2026 at 22:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 28 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing it against the option length len. When a registered path segment is longer than the supplied URI and the URI is a prefix of it, the loop reads uri[len] and beyond, past the end of the option value. The path is reached from coap_well_known_core_get_len() and coap_well_known_core_get() via match_queries_resource(), i.e. by any unauthenticated GET /.well-known/core?href=/<prefix> request to a device that serves /.well-known/core (for the CoAP server subsystem, CONFIG_COAP_SERVER_WELL_KNOWN_CORE, default y) and has at least one resource that declares struct coap_core_metadata attributes. The over-read does not reach the receive buffer. The well-known-core builders parse the query into a stack-local struct coap_option, whose value is a fixed array (value[12], or CONFIG_COAP_EXTENDED_OPTIONS_LEN_VALUE bytes) that the option bytes are copied into, so uri points into that copy. Reading past len therefore reads the unused, uninitialized tail of the array and, when the option fills it, the bytes just past it in the same stack frame. (In the ZoAP library of v1.8.0 to v1.9.x the option value was instead a pointer into the received packet, and the over-read ran past the option inside the packet buffer.) The impact is bounded. The number of bytes read past the end is limited by the length of the resource path segment, and each additional byte is only read if it happens to equal the next path character, so in practice the over-read is one byte. It also cannot influence the response: returning a match requires the final compared index to be len - 1 or len, both in bounds, so out-of-bounds bytes only ever steer the loop to the next candidate resource. The consequence is undefined behaviour, not information disclosure and not a matching error. The fix adds a k >= len guard at the top of the inner loop, so every uri[k] dereference is within the option value while still allowing a trailing * wildcard to match a longer path.
Title Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-09-30T15:28:20.615Z

Reserved: 2026-07-30T17:54:12.762Z

Link: CVE-2026-18416

cve-icon Vulnrichment

Updated: 2026-09-30T15:27:31.086Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-28T21:17:17.560

Modified: 2026-09-30T16:17:12.250

Link: CVE-2026-18416

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T22:15:09Z

Weaknesses