What is CVE-2018-12680?

CVE-2018-12680 is a high-severity vulnerability in Coapthon Project, classified under Deserialization of Untrusted Data. CVSS score: 7.5/10. Published 2019-04-02.

How severe is CVE-2018-12680?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2018-12680 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Coapthon Project

CVE-2018-12680

The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect CoAP server and client) when they receive crafted CoAP messages.

Vulnerability class: Insecure Deserialization

Published 2019-04-02 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.015 (73.4th percentile), scored 2026-10-02.

Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000

Affected products

Coapthon Project — versions 3.1, 4.0.0, 4.0.1

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

github.com/Tanganelli/CoAPthon/issues/135 (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2018-12680?: CVE-2018-12680 is a high-severity vulnerability in Coapthon Project, classified under Deserialization of Untrusted Data. CVSS score: 7.5/10. Published 2019-04-02.
How severe is CVE-2018-12680?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2018-12680 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.