CVE-2026-58465: Eclipse-Wakaama Wakaama

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers. Attackers can target the registration endpoint over UDP without authentication, causing the server to repeatedly reallocate a growing accumulation buffer by appending each block payload without enforcing any maximum total size limit, resulting in denial of service through memory exhaustion.

Affected products

• Eclipse-Wakaama Wakaama

Published 2026-07-02. Last modified 2026-07-14.