CVE-2020-12885

An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse_multiple_options() parses CoAP options in a while loop. This loop's exit condition is computed using the previously allocated heap memory required for storing the result of parsing multiple options. If the input heap memory calculation results in zero bytes, the loop exit condition is never met and the loop is not terminated. As a result, the packet parsing function never exits, leading to resource consumption.

• CWE-835

• https://github.com/ARMmbed/mbed-coap/pull/116Third Party Advisory
• https://github.com/ARMmbed/mbed-os/issues/12929Third Party Advisory
• https://github.com/ARMmbed/mbed-coap/pull/116Third Party Advisory
• https://github.com/ARMmbed/mbed-os/issues/12929Third Party Advisory

Published

Jun 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12877Veritas APTARE versions prior to 10.4 allowed sensitive info…7.5
• CVE-2020-12878Digi ConnectPort X2e before 3.2.30.6 allows an attacker to e…7.8
• CVE-2020-12880An issue was discovered in Pulse Policy Secure (PPS) and Pul…5.5
• CVE-2020-12882Submitty through 20.04.01 allows XSS via upload of an SVG do…5.4
• CVE-2020-12883Buffer over-reads were discovered in the CoAP library in Arm…9.1
• CVE-2020-12884A buffer over-read was discovered in the CoAP library in Arm…9.1
• CVE-2020-12886A buffer over-read was discovered in the CoAP library in Arm…9.1
• CVE-2020-12887Memory leaks were discovered in the CoAP library in Arm Mbed…7.5
• CVE-2020-12888The VFIO PCI driver in the Linux kernel through 5.6.13 misha…5.3
• CVE-2020-12889MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection…9.8
• CVE-2020-1289A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
• CVE-2020-12890Improper handling of pointers in the System Management Mode …6.7