Contiki-NG mDNS Resolver resolv.c skip_name out-of-bounds

Summaryinfo

A vulnerability was found in Contiki-NG. It has been declared as critical. This vulnerability affects the function skip_name of the file os/services/resolv/resolv.c of the component mDNS Resolver. Such manipulation leads to out-of-bounds. This vulnerability is referenced as CVE-2026-5856. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Contiki-NG (version now known). Affected by this issue is the function skip_name of the file os/services/resolv/resolv.c of the component mDNS Resolver. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-5856 since 04/08/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Applying the patch 04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Contiki-NG

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion