CVE-2026-26456

A null pointer dereference (CWE-476) caused by a race condition (CWE-362) exists in the server-side session management logic of ccoap at commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5, where the request dispatch thread and the session cleanup thread access shared session list nodes without proper synchronization. An attacker who can send network requests to an affected ccoap server can trigger the race by forcing concurrent session handling and cleanup, causing the server to dereference a NULL session node. The result is a denial of service (crash or hang of the server process), with no confidentiality or integrity impact per the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability only). Any deployment running the affected ccoap build as a network-facing server with session management enabled is exposed; the affected version range beyond the referenced commit is not specified in the advisory data. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Determine whether your ccoap server build corresponds to commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 and monitor the upstream repository for a patch that adds synchronization around shared session list access; no fixed version is stated in the advisory. In the meantime, restrict network exposure of affected CoAP services, monitor for crashes or hangs under session churn, and restart affected server processes as needed. With no known exploitation and low EPSS, treat this as a routine-availability patch rather than an urgent incident.