CVE-2026-5856
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Contiki-NG's DNS/mDNS resolver in skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() iterates nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker can set nquestions higher than the number of complete questions, causing out-of-bounds reads past the UDP packet buffer and disclosing memory contents or crashing the resolver.
Risk Assessment
The vulnerability allows an unauthenticated attacker on the local network to read memory or cause a crash, potentially leading to data leakage or service unavailability.
Recommendation
Update Contiki-NG to a patched version. Restrict access to DNS/mDNS services and filter multicast packets.
Other vulnerabilities in Contiki-NG
See all- CVE-2026-5857High
Contiki-NG's MQTT client in parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, the parser skips the length-reading block and performs a memcpy with an unvalidated length, leading to overflow of the topic[] buffer and overwriting adjacent fields, including the payload_chunk pointer. This can enable remote code execution on devices without memory protection.
- CVE-2026-5855High
Contiki-NG's LwM2M TLV parser in lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. A crafted CoAP WRITE with a final TLV supplying exactly one byte triggers up to five out-of-bounds reads of heap memory, disclosing memory contents (including key material and peer addresses) through the parsed tlv->id, tlv->length, and tlv->value fields. In LwM2M NoSec mode, the default for constrained devices, no authentication is required.
- CVE-2023-34101High
Contiki-NG is an operating system for IoT devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the system does not verify that the packet buffer is large enough, which can lead to out-of-bounds reads.
- CVE-2023-34100High
Contiki-NG, an operating system for IoT devices, has a vulnerability that allows reading data out of bounds of the IPv6 buffer when processing the MSS option in TCP packets. The issue involves buffer indexing in the module os/net/ipv6/uip6.c, which may lead to unauthorized memory access.
Original NVD description (English source)
Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.