An issue was discovered in Contiki through 3.0.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.
Summary
An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet, there is an attempt to remove the RPL extension headers. Because the packet length and the extension header length are unchecked (with respect to the available data) at this stage, and these variables are susceptible to integer underflow, it is possible to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condition. This is related to rpl-ext-header.c.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:contiki-os:contiki:*:*:*:*:*:*:*:* | up to 3.0 | Vulnerable | Contiki-os |
- cpe:2.3:o:contiki-os:contiki:*:*:*:*:*:*:*:* Versions up to 3.0 Vulnerable ·Contiki-os
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28362
- 2026-10-03 Alias added: GHSA-pcjq-cmp7-76vx
References
More Contiki-os Contiki vulnerabilities
- TI-2020-14885 An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. CVSS 3.1CRITICAL 9.8
- TI-2019-06001 An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. CVSS 3.1CRITICAL 9.8
- TI-2020-10954 An issue was discovered in Contiki through 3.0. CVSS 3.1HIGH 7.5
- TI-2020-10955 An issue was discovered in Contiki through 3.0. CVSS 3.1HIGH 7.5
- TI-2019-06643 An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. CVSS 3.1HIGH 7.5
- TI-2020-10953 An issue was discovered in Contiki through 3.0. CVSS 3.1HIGH 7.5
Sources
- CVE-2021-28362 · CVE Program
- CVE-2021-28362 · NVD
- FIRST EPSS
- GHSA-pcjq-cmp7-76vx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences