Read the docs
TI-2026-05135 Aliases CVE-2026-5856GHSA-8m55-g479-xj8c

Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip_name Traversal Before Transaction-ID Validation

Priority LOW 31CWE-125Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed Contiki-NG (Contiki-NG): 04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
contiki-ngContiki-NGbefore 04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffePatch availableCNA
  • Contiki-NG Vendorcontiki-ng Affected before 04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe Fixed in 04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*——contiki-ng
  • cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:* Versions — — ·contiki-ng

Remediation

  • Fix · CNA Contiki-NG (Contiki-NG) Fixed in 04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5856
  2. 2026-10-03 Alias added: GHSA-8m55-g479-xj8c

References

Patch 2

Other 1

  • TI-2020-14885 An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. CVSS 3.1CRITICAL 9.8
  • TI-2021-18649 An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. CVSS 3.1CRITICAL 9.8
  • TI-2020-16751 In Contiki 4.5, TCP ISNs are improperly random. CVSS 3.1CRITICAL 9.1
  • TI-2018-16029 contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query… CVSS 3.1CRITICAL 9.8
  • TI-2018-13749 An issue was discovered in the MQTT server in Contiki-NG before 4.2. CVSS 3.0CRITICAL 10.0
  • TI-2023-14381 Contiki-NG has off-by-one error in Antelope DBMS CVSS 3.1CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences