CVE-2026-5856 in Contiki-NG
Summary
by MITRE • 08/07/2026
Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Contiki-NG's DNS/mDNS resolver represents a critical buffer overflow condition that stems from inadequate input validation within the skip_name() function located in os/services/resolv/resolv.c. This flaw operates at the intersection of improper input validation and memory safety issues, specifically manifesting as a classic out-of-bounds read vulnerability that can be exploited through malformed DNS responses. The technical implementation suffers from a fundamental lack of boundary checking when processing DNS wire-format name labels, where the function processes label data without verifying that the packet boundaries are respected during traversal operations.
The operational impact of this vulnerability becomes particularly severe when considering the context in which the affected code executes. Within the newdata() function, skip_name() is invoked in a loop that iterates based on the nquestions field from the attacker-controlled DNS header, regardless of whether complete questions actually exist within the packet buffer. This design flaw creates a scenario where an attacker can manipulate the nquestions value to exceed the actual number of valid DNS questions present in the UDP packet, causing the skip_name() function to traverse beyond the allocated uip_buf memory boundaries. The vulnerability is classified as a CWE-129 issue, representing an improper validation of array index or buffer bounds, while also aligning with ATT&CK technique T1059.007 for execution through DNS resolution.
The exploitation vector differs slightly between mDNS and standard DNS configurations but maintains the same underlying memory safety concern. In environments where RESOLV_CONF_SUPPORTS_MDNS is enabled, any network peer can trigger this vulnerability through a simple multicast UDP packet sent to port 5353 without requiring an active query, making it particularly dangerous in local network segments where such injection is feasible. For standard DNS configurations, the attack requires packet injection during an active DNS query from port 53, but still achieves the same memory access violation. The attacker-controlled pointer returned by skip_name() gets cast to struct dns_answer * for subsequent memory reads, amplifying the potential impact beyond simple information disclosure.
The memory access violation results in reading from uip_buf and adjacent memory regions, potentially exposing sensitive data such as network buffers, cryptographic keys, or application state information that may be stored in nearby memory locations. This out-of-bounds read can lead to information leakage that might reveal internal system structures, authentication tokens, or other confidential data contained within the memory space. Additionally, the memory corruption can cause unpredictable behavior including application crashes or denial of service conditions, making this vulnerability not only a data exposure risk but also a potential availability threat. The impact extends beyond immediate memory contents disclosure to potentially enabling more sophisticated attacks through information leakage that could aid in bypassing security controls or exploiting other system weaknesses.
Mitigation strategies must address both the immediate code-level fix and broader architectural considerations for DNS resolution services. The primary remediation involves implementing proper boundary checking within skip_name() to validate that label traversal operations do not exceed packet buffer limits, ensuring that the function validates against available packet data before proceeding with memory operations. Network-level protections should include rate limiting and packet filtering mechanisms that restrict unauthorized DNS traffic, particularly on port 5353 for mDNS implementations. Additionally, implementing proper transaction ID validation and ensuring that DNS responses are only processed when they match expected query identifiers will significantly reduce the attack surface. Organizations should also consider deploying network segmentation strategies to limit the scope of potential exploitation, while regular firmware updates and security audits should be conducted to identify similar vulnerabilities in embedded networking stacks. The fix must align with secure coding practices that emphasize defensive programming principles and input validation as recommended by both CWE guidelines and industry best practices for embedded systems security.