# CVE-2026-5856: Contiki-NG DNS resolver out-of-bounds read in skip_name()

Source: https://junglewise.ai/threats/cve-2026-5856-contiki-ng-dns-resolver-out-of-bounds-read-in-skip-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-5856 · Severity: high · CVSS 7.1 · Published 2026-08-06

Contiki-NG is an operating system for IoT devices that includes a DNS and multicast DNS resolver. A bug in the DNS name parsing logic fails to validate packet boundaries before reading DNS wire-format labels, allowing an attacker to read memory beyond the packet buffer. On multicast DNS configurations, any local network peer can trigger this without authentication; on standard DNS, an attacker injecting forged DNS responses can exploit it. This can disclose sensitive memory contents or crash the resolver, disrupting network connectivity.

Technologies: [Contiki-NG](https://junglewise.ai/threats/technologies/contiki-ng). Vendors: [Contiki-NG](https://junglewise.ai/threats/vendors/contiki-ng).

## Quick answers

**Is CVE-2026-5856 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5856 being exploited in the wild.

**How severe is CVE-2026-5856?** High severity, with a CVSS score of 7.1, published 6 August 2026.

**Which products and versions are affected?** Contiki-NG prior to commit 04a3f0a (2026-07-08).

**Is there a fix for CVE-2026-5856?** A patch was published on 2026-07-08: Merge of bounds-checking fix in commit 04a3f0a Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5856 attacked?** It is attacked over the network or from the adjacent network, in an operating system.

**Am I affected by CVE-2026-5856?** Check whether you run Contiki-NG at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing bounds check in the skip_name() function in os/services/resolv/resolv.c. The DNS name parsing code walks DNS wire-format name labels without validating that the pointer remains within the packet buffer, and the caller newdata() invokes skip_name() in a loop nquestions times based on an attacker-controlled DNS header field before validating the transaction ID. When nquestions exceeds the number of complete questions present, skip_name() reads past the UDP packet buffer (uip_buf), and the out-of-bounds pointer is cast to struct dns_answer * for further reads. On MDNS-enabled builds, any peer on the local network segment can trigger this via multicast UDP 5353 without an outstanding query; standard DNS builds require an attacker who can inject UDP responses from port 53 during an outstanding query. Impact includes out-of-bounds memory reads disclosing uip_buf and adjacent memory, or denial of service via resolver crash. A fix adding proper bounds checking was committed on 2026-07-08.

## Affected products

- Contiki-NG Contiki-NG prior to commit 04a3f0a (2026-07-08)

## Timeline

- 2026-08-06: disclosed
- 2026-07-08: patched: Merge of bounds-checking fix in commit 04a3f0a

## References

- [https://github.com/contiki-ng/contiki-ng](https://github.com/contiki-ng/contiki-ng)
- [https://github.com/contiki-ng/contiki-ng/commit/04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe](https://github.com/contiki-ng/contiki-ng/commit/04a3f0a0067d2ee87d1f297b6d0f4392d8c98ffe)

## Related threats

- [Contiki-NG MQTT client buffer overflow in topic parsing](https://junglewise.ai/threats/cve-2026-5857-contiki-ng-mqtt-client-buffer-overflow-in-topic-parsing)
- [Contiki-NG LwM2M TLV parser buffer over-read in lwm2m_tlv_read()](https://junglewise.ai/threats/cve-2026-5855-contiki-ng-lwm2m-tlv-parser-buffer-over-read-in-lwm2m-tlv-read)