CVE-2024-0962 is a medium severity flaw (CVSS 6.3) in libcoap. Pull request 1311 fixed it in the develop branch on 26 January 2024, by handling comments in an OSCORE configuration file that uses DOS line endings. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
libcoap 4.3.4, function get_split_entry in src/coap_oscore.c, in the configuration file handler.
The record gives a CVSS base score of 6.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The weakness class is CWE-121, CWE-787.
The record scores this 6.3 Medium. The overflow occurs when parsing an OSCORE configuration file, so exposure depends on whether untrusted input can reach that file.
The record says exploit details have been disclosed publicly, so assume that attackers can learn how the weakness works. Pull request 1311 fixed it in the develop branch on 26 January 2024, by handling comments in an OSCORE configuration file that uses DOS line endings. The page does not name a release, so check the libcoap release notes.
How to check if you're exposed
For packages: dpkg -l | grep -i libcoap or rpm -qa | grep -i libcoap. For source builds, check the version in configure.ac. Also check embedded images and containers, which may link libcoap statically.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0962 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of libcoap in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. Pull request 1311 fixed it in the develop branch on 26 January 2024, by handling comments in an OSCORE configuration file that uses DOS line endings.
- Apply mitigations while you wait: use a build that includes the pull request and restrict who can edit OSCORE configuration files.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is a stack-based buffer overflow. A function copies a request value into a fixed size buffer on the stack without checking its length, so an oversized value overwrites neighbouring memory. At minimum the web service crashes. Depending on the device and its protections, memory corruption can be more serious than a crash.
Embedded firmware often lacks the exploit mitigations that desktop systems take for granted, which is why this class matters even when the scoring looks moderate. The reliable fix is a firmware update that checks lengths before copying. Without one, reducing who can reach the web interface is the main control.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a Medium score mean I can ignore it?
No. The score reflects needed privileges. Memory corruption bugs on embedded devices deserve a plan, even if the plan is isolation.
Where can I confirm the fixed version?
Check the vendor or project advisory first. Pull request 1311 fixed it in the develop branch on 26 January 2024, by handling comments in an OSCORE configuration file that uses DOS line endings. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://github.com/obgm/libcoap/issues/1310
- https://github.com/obgm/libcoap/issues/1310#issue-2099860835
- https://github.com/obgm/libcoap/pull/1311
- https://vuldb.com/?ctiid.252206
- Safeguard Gold record for CVE-2024-0962
Last reviewed: 19 October 2026.
