Contiki-NG's MQTT client is vulnerable to a critical issue (CVE-2026-5857) due to improper handling of topic lengths in the parse_publish_vhdr() function. This allows an attacker to trigger a memcpy operation with an unvalidated length, potentially leading to a buffer overflow and arbitrary-pointer-write primitive. The issue is exacerbated by the lack of TLS support in Contiki-NG's MQTT implementation, ma [truncated]
Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk pas [truncated]
Contiki-NG's LwM2M TLV parser has a bounds check issue, CVE-2026-5855, allowing up to five out-of-bounds reads of heap memory adjacent to the CoAP input buffer. This occurs because the parser ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. Organizations using Contiki-NG, especially in constrained device environments, should be aware [truncated]
