Read the docs
TI-2026-05136 Aliases CVE-2026-5857GHSA-x5g5-4jq8-vj28

Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments

Priority MEDIUM 47CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00919 60th percentileScored 2026-11-07
Fix Fixed Contiki-NG (Contiki-NG): a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
contiki-ngContiki-NGbefore a34a2dbdc8bea784bd2ae5079aa4be520cd74f2da34a2dbdc8bea784bd2ae5079aa4be520cd74f2dPatch availableCNA
  • Contiki-NG Vendorcontiki-ng Affected before a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d Fixed in a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:*——contiki-ng
  • cpe:2.3:o:contiki-ng:contiki-ng:*:*:*:*:*:*:*:* Versions — — ·contiki-ng

Remediation

  • Fix · CNA Contiki-NG (Contiki-NG) Fixed in a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5857
  2. 2026-10-03 Alias added: GHSA-x5g5-4jq8-vj28

References

Patch 1

Other 3

  • TI-2020-14885 An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. CVSS 3.1CRITICAL 9.8
  • TI-2021-18649 An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. CVSS 3.1CRITICAL 9.8
  • TI-2020-16751 In Contiki 4.5, TCP ISNs are improperly random. CVSS 3.1CRITICAL 9.1
  • TI-2018-16029 contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query… CVSS 3.1CRITICAL 9.8
  • TI-2018-13749 An issue was discovered in the MQTT server in Contiki-NG before 4.2. CVSS 3.0CRITICAL 10.0
  • TI-2023-14381 Contiki-NG has off-by-one error in Antelope DBMS CVSS 3.1CRITICAL 9.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences