Golioth Pouch up to 0.1.0 Server Certificate Parser server_cert_write heap-based overflow

Summaryinfo

A vulnerability classified as critical was found in Golioth Pouch up to 0.1.0. This affects the function server_cert_write of the component Server Certificate Parser. Such manipulation leads to heap-based overflow. This vulnerability is documented as CVE-2026-23750. The attack requires being on the local network. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Golioth Pouch up to 0.1.0 and classified as critical. Affected by this issue is the function server_cert_write of the component Server Certificate Parser. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; integrity impact is also possible due to memory corruption.

The weakness was released by Secmate. The advisory is available at github.com. This vulnerability is handled as CVE-2026-23750 since 01/15/2026. The exploitation is known to be easy. The attack needs to approached within the local network. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 0.22.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 1b2219a1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Golioth

Name

• Pouch

Version

• 0.1.0

License

• open-source

Website

• Product: https://github.com/golioth/pouch/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion