A race condition between the request dispatch thread and the session cleanup thread in ccoap causes a null pointer dereference when accessing shared session list nodes without proper synchronization. This flaw can trigger a crash of the CoAP server, leading to an interruption of service for clients. The vulnerability does not grant an attacker direct code execution or data exfiltration, but the resulting server shutdown constitutes a denial‑of‑service impact serious enough to impair availability of the affected service.

The vulnerability exists in the ccoap software at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. No specific vendor or version number is listed, so any installation of ccoap that includes the indicated commit is susceptible. Because the code is open source, unintended custom forks that replicate the same logic are also at risk.

The CVSS score is not provided, and the EPSS score is currently unavailable, which suggests insufficient data to calculate a precise risk metric. However, the lack of a KEV listing indicates that no publicly known exploit has been observed to date. Despite that, the race condition can be triggered by normal traffic patterns or by a deliberately high‑rate request load, potentially allowing an attacker to repeatedly induce crashes. Given the impact of service downtime in production environments, the overall risk should be considered medium to high when the service is critical.