CVE-2025-65501

CVE-2025-65501 describes a null pointer dereference vulnerability in OISM libcoap 4.3.5, specifically within the coap_dtls_info_callback() function. This flaw allows a remote attacker to trigger a denial of service by initiating a DTLS handshake where SSL_get_app_data() returns NULL. The vulnerability has a CVSS score of 4.3 (MEDIUM), indicating a low-impact denial of service that can be triggered remotely with low attack complexity, requiring no privileges or user interaction. While the EPSS score is very low, suggesting a low probability of exploitation, the FAUCET Risk Score is 29/100. Currently, there is no known active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered no community discussion or media coverage, which is typical for the vast majority of CVEs.