Golioth Firmware SDK up to 0.21.x blockwise_transfer_init null termination

Summaryinfo

A vulnerability classified as problematic has been found in Golioth Firmware SDK up to 0.21.x. The impacted element is the function blockwise_transfer_init. This manipulation causes null termination. This vulnerability is registered as CVE-2026-23749. The attack needs to be launched locally. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Golioth Firmware SDK up to 0.21.x and classified as problematic. Affected by this vulnerability is the function blockwise_transfer_init. The manipulation with an unknown input leads to a null termination vulnerability. The CWE definition for the vulnerability is CWE-170. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. As an impact it is known to affect availability. The summary by CVE is:

Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a crash/denial of service. The input is application-controlled (not network by default).

The weakness was published by Secmate. The advisory is shared at github.com. This vulnerability is known as CVE-2026-23749 since 01/15/2026. The exploitation appears to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.22.0 or commit 0e788217 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0e788217ab4b61a7c1d9fadd1b4a40f5f538a26d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• Golioth

Name

• Firmware SDK

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion