The vulnerability resides in the CoAP Block1 handler of Eclipse Wakaama, where an unbounded memory allocation occurs when processing a series of Block1 PUT requests. A remote attacker can send these requests without any authentication, causing the server to repeatedly reallocate a growing buffer by appending each block payload. This unchecked growth can exhaust server memory and trigger a denial of service. The weakness is a classic example of CWE‑770, Uncontrolled Resource Consumption.

The flaw affects all instances of Eclipse Wakaama running versions before the snapshot/2026-05-26 release. This includes deployments that have not applied the latest rollback or patch. When an adversary targets the CoAP registration endpoint over UDP, the server, unaware of the maximum total payload size, accumulates incoming blocks until resources are depleted.

With a CVSS score of 8.7 the vulnerability is considered high severity, while the EPSS score of less than 1% indicates a low to very low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog, but it remains a valid threat for any unpatched installation. Attackers can exploit it remotely, requiring only the ability to reach the CoAP service; no authentication or privileged access is needed.