A null pointer dereference occurs in ccoap’s coap_dump_msg() function when parsing CoAP messages that include options of zero length. This flaw causes the application to crash, resulting in a denial‑of‑service condition that can affect any process or service using the vulnerable library. The primary weakness is a null pointer dereference, which is a direct exploitation vector considered a software defect capable of causing uncontrolled crashes.

The vulnerability exists in the ccoap project, specifically in the codebase identified by commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. No vendor or additional product information is available, nor are version ranges specified; any deployment utilizing this commit or earlier instructions from the ccoap repository is potentially impacted.

The CVSS score is 7.5, and the EPSS score is < 1%. Since the vulnerability leads to a crash when a crafted message is received, an attacker can reliably cause a denial of service by sending a CoAP packet containing a zero‑length option to a vulnerable node. The vulnerability is not listed in CISA’s KEV catalog, implying no known public exploitation at the time of reporting. Based on the description, it is inferred that the attack vector is network‑based, as the flaw is triggered by receiving a malformed CoAP packet over the network.