CVE-2026-5857

Received Received - Intake

MQTT Topic Length Validation Flaw in Contiki-NG

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, falling through directly to a memcpy() that uses the unvalidated 16-bit topic_len as the copy length. The 65-byte topic[] destination overruns into adjacent struct fields including the payload_chunk pointer, which subsequent MQTT code dereferences, giving a compromised or attacker-controlled broker an arbitrary-pointer-write primitive. Contiki-NG's MQTT implementation has no TLS support so the connection is plaintext. Impact ranges from information disclosure and denial of service to remote code execution on embedded targets without memory protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-5857

Affected Vendors & Products

Vendor	Product	Version / Range
contiki-ng	contiki-ng	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in Contiki-NG's MQTT client where a topic length check is bypassed due to improper flag handling. The parser sets a flag before validating the topic length, allowing an over-length topic to bypass checks. On subsequent parsing, the flag causes the length-reading block to be skipped, leading to a buffer overflow when copying data. This results in an arbitrary pointer write, enabling remote code execution or denial of service on vulnerable embedded devices.

Detection Guidance

This vulnerability involves a buffer overflow in Contiki-NG's MQTT client due to improper topic length validation. Detection requires inspecting MQTT traffic for malformed packets with topics exceeding 64 bytes. Use packet capture tools like tcpdump or Wireshark to monitor MQTT traffic on port 1883 (default MQTT port) for unusually long topic fields. Check for crashes or memory corruption in embedded devices running Contiki-NG after receiving MQTT messages.

Impact Analysis

This vulnerability can lead to information disclosure, denial of service, or remote code execution on affected embedded devices running Contiki-NG's MQTT client. Since the MQTT connection is plaintext, an attacker on the network can exploit this to gain control over the device or extract sensitive data.

Mitigation Strategies

Immediately disable MQTT in Contiki-NG if not required. If MQTT is essential, isolate devices running Contiki-NG from untrusted networks. Apply patches or updates from Contiki-NG if available. Use network segmentation to limit exposure. Since the MQTT implementation lacks TLS, avoid using it on untrusted networks to prevent plaintext interception and manipulation.

Hi! I’m here to help you understand CVE-2026-5857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70