An issue in the option parsing logic of ccoap causes a segmentation fault when the program processes CoAP messages that contain invalid option numbers. The fault arises from improper handling of these option numbers, leading to an out‑of‑bounds memory access that crashes the running process. The crash terminates any service that relies on ccoap, resulting in a denial of service to legitimate clients and potentially disrupting downstream systems that depend on the affected endpoint.

The vulnerability exists in the ccoap implementation identified by commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. All installations of ccoap that include this commit or earlier versions that have not applied the patch are impacted. Users of ccoap who rely on this commit should verify their current version and upgrade if necessary.

Because the segmentation fault can be triggered by malformed CoAP messages, an attacker who can reach the CoAP endpoint may be able to induce service outages. While no exploit probability score is available and the vulnerability is not listed in the KEV catalog, the presence of a crash condition indicates a moderate to high likelihood of denial‑of‑service exploitation, especially in environments where the CoAP service is exposed to untrusted networks. Preventing this outcome hinges on applying the patch or obviating the vulnerability through input validation or traffic filtering.