Description
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).
Published: 2026-02-26
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Update
AI Analysis

Impact

Golioth Firmware SDK versions prior to 0.22.0 contain an out‑of‑bounds read that results from copying a blockwise transfer path into a fixed‑size buffer without appending a terminating NUL byte. The buffer is later processed with a strlen call, allowing the code to read beyond the allocated memory and trigger a crash. This flaw is a classic example of CWE‑170 Improper Null Termination and can lead to a denial of service for the device that is running the vulnerable SDK.

Affected Systems

The vulnerability affects all releases of the Golioth Firmware SDK with versions 0.19.1 and earlier than 0.22.0. The issue is fixed in commit 0e788217 and subsequent releases such as 0.22.0 and later.

Risk and Exploitability

The CVSS score of 2.1 indicates low overall severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The attack surface is limited to application‑controlled input; the vulnerability is not remotely exploitable over the network by default. Even though exploitation would only cause a crash, the limited scope reduces the urgency but still warrants mitigation by upgrading the SDK.

Generated by OpenCVE AI on April 16, 2026 at 06:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Golioth Firmware SDK to version 0.22.0 or newer to eliminate the null‑termination bug.
  • If an immediate SDK upgrade is infeasible, review and sanitize all application‑controlled paths passed to blockwise_transfer_init so that they are properly null‑terminated and within the maximum path length limits before being processed by the SDK.
  • After applying changes, monitor device logs for any unexpected crashes or reboots that might indicate leftover vulnerabilities or path handling errors.

Generated by OpenCVE AI on April 16, 2026 at 06:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 27 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 27 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
References

Fri, 27 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Golioth
Golioth firmware Sdk
Vendors & Products Golioth
Golioth firmware Sdk

Thu, 26 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
References

Thu, 26 Feb 2026 18:00:00 +0000

Type Values Removed Values Added
Description Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).
Title Golioth Firmware SDK < 0.22.0 Blockwise Transfer Path Out-of-Bounds Read
Weaknesses CWE-170
References
Metrics cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Golioth Firmware Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-23T15:44:14.063Z

Reserved: 2026-01-15T18:42:20.938Z

Link: CVE-2026-23749

cve-icon Vulnrichment

Updated: 2026-02-27T17:56:03.908Z

cve-icon NVD

Status : Deferred

Published: 2026-02-26T18:23:06.763

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-23749

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T06:15:26Z

Weaknesses