CVE-2026-5856

Received Received - Intake

DNS Name Parsing Out-of-Bounds Read in Contiki-NG

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-5856

Affected Vendors & Products

Vendor	Product	Version / Range
contiki-ng	contiki-ng	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in Contiki-NG's DNS/mDNS resolver involves a boundary check flaw in the skip_name() function. An attacker can manipulate the DNS header's nquestions field to exceed the actual number of questions, causing the function to read past the UDP packet buffer. This leads to an out-of-bounds memory read, potentially exposing sensitive data or crashing the resolver.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual DNS/mDNS traffic patterns or memory access violations. Check for multicast UDP packets on port 5353 targeting your DNS resolver. Inspect logs for resolver crashes or memory disclosure events. Use network sniffing tools like tcpdump or Wireshark to capture and analyze DNS/mDNS traffic for malformed packets with excessive question counts.

Impact Analysis

The impact includes unauthorized memory disclosure or denial-of-service attacks. On systems with RESOLV_CONF_SUPPORTS_MDNS enabled, any local network peer can exploit this without prior interaction. Otherwise, an attacker must inject a malicious DNS response during an active query to trigger the flaw.

Mitigation Strategies

Immediately update Contiki-NG to the latest patched version. Disable RESOLV_CONF_SUPPORTS_MDNS if enabled to prevent multicast UDP attacks. Implement network-level controls to block or filter unsolicited DNS/mDNS traffic on port 5353. Monitor resolver processes for crashes or memory leaks as indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-5856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70