libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code execution depending on compiler options and runtime memory protections. Exploitation requires the proxy logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a8ee24f019 advisory.

    Update to 4.3.5b


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0ce923a09d advisory.

    Update to 4.3.5b


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-148e35657a advisory.

    Update to 4.3.5b


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow     in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer     without proper bounds checking. A remote attacker can trigger a crash and potentially achieve remote code     execution depending on compiler options and runtime memory protections. Exploitation requires the proxy     logic to be enabled (i.e., the proxy request handling code path in an application using libcoap).
    (CVE-2025-34468)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310593	Fedora 42 : libcoap (2026-a8ee24f019)	Nessus	Fedora Local Security Checks	high
310587	Fedora 43 : libcoap (2026-0ce923a09d)	Nessus	Fedora Local Security Checks	high
310579	Fedora 44 : libcoap (2026-148e35657a)	Nessus	Fedora Local Security Checks	high
281560	Linux Distros Unpatched Vulnerability : CVE-2025-34468	Nessus	Misc.	high

Detections

Analytics

CVE-2025-34468

high

Tenable Plugins

high

high

high

high