CVE-2026-5856

Name of the Vulnerable Software and Affected Versions Contiki-NG (affected versions not specified)

Description The DNS/mDNS resolver contains an issue where the skip name() function in os/services/resolv/resolv.c processes DNS wire-format name labels without performing packet-boundary checks. The newdata() function calls skip name() in a loop based on the nquestions value from the DNS header before the transaction ID is validated. If an attacker provides an nquestions value higher than the actual number of complete questions, the resolver reads past the UDP packet buffer. This results in an out-of-bounds read of uip buf and adjacent memory, which can lead to memory disclosure or a system crash. In builds with RESOLV CONF SUPPORTS MDNS enabled, this can be triggered unauthenticated via a multicast UDP 5353 packet. In standard DNS builds, it can be triggered by injecting a UDP response from port 53 during an active query.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.