A race condition in the ccoap source code causes a null pointer dereference when the request dispatch thread and the session cleanup thread concurrently access shared session list nodes without proper synchronization. The resulting bug crashes the CoAP server, interrupting service for all clients. The vulnerability does not provide attackers with code execution or data exfiltration capabilities, so the impact is purely a denial‑of‑service.

The flaw exists in any deployment of the ccoap server that contains the code at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. Since this is an open‑source project, custom forks or installations that replicate the same session‑management logic are also at risk. No commercial vendor is listed, so mitigation relies on project maintainers or independent developers applying the fix.

The CVSS score of 7.5 marks the issue as high severity, while the EPSS score of <1% indicates a low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. Nevertheless, because the race condition can be triggered by normal traffic patterns or by deliberately high request rates, an attacker could repeatedly induce crashes. The overall risk, especially for production environments where availability is critical, can be considered medium to high.