# cve.now: Contiki-ng

The newest entries naming Contiki-ng as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-5857](https://cve.now/CVE-2026-5857.md): Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments (CVSS 8.1)
- [CVE-2026-5856](https://cve.now/CVE-2026-5856.md): Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip\_name Traversal Before Transaction-ID Validation (CVSS 7.1)
- [CVE-2026-5855](https://cve.now/CVE-2026-5855.md): Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m\_tlv\_read (CVSS 7.5)
- [CVE-2023-29001](https://cve.now/CVE-2023-29001.md): Uncontrolled recursion due to insufficient validation of the IPv6 source routing header in Contiki-NG (CVSS 8.7)
- [CVE-2024-41125](https://cve.now/CVE-2024-41125.md): Out-of-bounds read in SNMP when decoding a string in Contiki-NG (CVSS 8.4)
- [CVE-2024-41126](https://cve.now/CVE-2024-41126.md): Out-of-bounds read when decoding SNMP messages in Contiki-NG (CVSS 8.4)
- [CVE-2024-47181](https://cve.now/CVE-2024-47181.md): Unaligned memory access in RPL option processing in Contiki-NG (CVSS 7.5)
- [CVE-2023-50926](https://cve.now/CVE-2023-50926.md): Unvalidated DIO prefix info length in RPL-Lite in Contiki-NG (CVSS 7.5)
- [CVE-2023-50927](https://cve.now/CVE-2023-50927.md): Insufficient boundary checks for DIO and DAO messages in RPL-Lite in Contiki-NG (CVSS 8.6)
- [CVE-2023-48229](https://cve.now/CVE-2023-48229.md): Out-of-bounds write in the radio driver for Contiki-NG nRF platforms (CVSS 7.0)
- [CVE-2023-37459](https://cve.now/CVE-2023-37459.md): Out-of-bounds read when processing a received IPv6 packet (CVSS 5.3)
- [CVE-2023-37281](https://cve.now/CVE-2023-37281.md): Out-of-bounds read during IPHC address decompression (CVSS 5.3)
- [CVE-2023-34101](https://cve.now/CVE-2023-34101.md): Contiki-NG vulnerable to out-of-bounds read when processing ICMP DAO input (CVSS 7.3)
- [CVE-2023-34100](https://cve.now/CVE-2023-34100.md): Out-of-Bounds Read in contiki-ng (CVSS 7.3)
- [CVE-2023-31129](https://cve.now/CVE-2023-31129.md): Contiki-NG missing NULL pointer check in IPv6 neighbor discovery (CVSS 7.5)
- [CVE-2023-30546](https://cve.now/CVE-2023-30546.md): Contiki-NG has off-by-one error in Antelope DBMS (CVSS 9.8)
- [CVE-2023-28116](https://cve.now/CVE-2023-28116.md): Buffer overflow in L2CAP due to misconfigured MTU (CVSS 8.1)
- [CVE-2023-23609](https://cve.now/CVE-2023-23609.md): contiki-ng BLE-L2CAP contains Improper size validation of L2CAP frames (CVSS 8.2)
- [CVE-2022-41972](https://cve.now/CVE-2022-41972.md): Contiki-NG contains NULL Pointer Dereference in BLE L2CAP module (CVSS 2.9)
- [CVE-2022-41873](https://cve.now/CVE-2022-41873.md): Out-of-bounds read and write in BLE L2CAP module (CVSS 4.2)
- [CVE-2022-36054](https://cve.now/CVE-2022-36054.md): Out-of-bounds write when decompressing 6LoWPAN payload in Contiki-NG (CVSS 6.8)
- [CVE-2022-36052](https://cve.now/CVE-2022-36052.md): Out-of-bounds read when decompressing UDP header (CVSS 5.9)
- [CVE-2022-36053](https://cve.now/CVE-2022-36053.md): Out-of-bounds read in the uIP buffer module (CVSS 5.9)
- [CVE-2022-35927](https://cve.now/CVE-2022-35927.md): Unverified DIO prefix info lengths in RPL-Classic in Contiki-NG (CVSS 8.1)
- [CVE-2022-35926](https://cve.now/CVE-2022-35926.md): Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG (CVSS 5.9)
- [CVE-2021-32771](https://cve.now/CVE-2021-32771.md): Buffer overflow in contiki-ng (CVSS 8.1)
- [CVE-2021-21410](https://cve.now/CVE-2021-21410.md): Out-of-bounds read in the 6LoWPAN implementation (CVSS 8.2)
- [CVE-2021-21257](https://cve.now/CVE-2021-21257.md): Out-of-bounds write in RPL-Classic and RPL-Lite (CVSS 8.2)
- [CVE-2021-21279](https://cve.now/CVE-2021-21279.md): Infinite loop in IPv6 neighbor solicitation processing (CVSS 7.5)
- [CVE-2021-21280](https://cve.now/CVE-2021-21280.md): Out-of-bounds write when processing 6LoWPAN extension headers (CVSS 8.6)
- [CVE-2021-21281](https://cve.now/CVE-2021-21281.md): Buffer overflow due to unvalidated TCP data offset (CVSS 7.0)
- [CVE-2021-21282](https://cve.now/CVE-2021-21282.md): Buffer overflow in RPL source routing header processing (CVSS 8.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/contiki-ng
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.