CVE-2026-5857 | High | 8.1 | 2026-08-06 | Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so… |
CVE-2026-5856 | High | 7.1 | 2026-08-06 | Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in ne… |
CVE-2026-5855 | High | 7.5 | 2026-08-06 | Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes fr… |
CVE-2024-47181 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of th… |
CVE-2024-41126 | High | 8.3 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a devi… |
CVE-2024-41125 | High | 8.3 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a devi… |
CVE-2023-29001 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing headers (SRH) in its tw… |
CVE-2023-50927 | High | 8.6 | 2024-02-14 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite impl… |
CVE-2023-50926 | High | 7.5 | 2024-02-14 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message w… |
CVE-2023-48229 | High | 7.0 | 2024-02-14 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write exists in the driver for IEEE 802.15.4 ra… |
CVE-2021-42147 | Critical | 9.1 | 2024-01-24 | Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attackers to cause a denia… |
CVE-2021-42146 | High | 7.5 | 2024-01-24 | An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two tim… |
CVE-2021-42145 | High | 7.5 | 2024-01-24 | An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of se… |
CVE-2021-42144 | Critical | 9.8 | 2024-01-24 | Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm… |
CVE-2021-42143 | Critical | 9.1 | 2024-01-24 | An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake messag… |
CVE-2021-42142 | Critical | 9.8 | 2024-01-23 | An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability… |
CVE-2021-42141 | Critical | 9.8 | 2024-01-22 | An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_He… |
CVE-2020-27634 | Critical | 9.1 | 2023-10-10 | In Contiki 4.5, TCP ISNs are improperly random. |
CVE-2023-37459 | Medium | 5.3 | 2023-09-15 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG network stack attempts t… |
CVE-2023-37281 | Medium | 5.3 | 2023-09-15 | Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when processing the various IPv6 header fields during IPHC header… |
CVE-2023-34101 | High | 7.3 | 2023-06-14 | Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` functio… |
CVE-2023-34100 | High | 7.3 | 2023-06-09 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet, the Contiki-NG OS… |
CVE-2023-31129 | High | 7.5 | 2023-05-08 | The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 router solicitiatio… |
CVE-2023-30546 | Critical | 9.8 | 2023-04-26 | Contiki-NG is an operating system for Internet of Things devices. An off-by-one error can be triggered in the Antelope database management system in the Contik… |
CVE-2023-28116 | High | 8.1 | 2023-03-17 | Contiki-NG is an open-source, cross-platform operating system for internet of things (IoT) devices. In versions 4.8 and prior, an out-of-bounds write can occur… |
CVE-2023-23609 | High | 8.2 | 2023-01-26 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to and including 4.8 are vulnerable to an out-of-… |
CVE-2022-41972 | Low | 2.9 | 2022-12-16 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE… |
CVE-2022-41873 | Medium | 4.2 | 2022-11-11 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 are vulnerable to an Out-of-bounds read. W… |
CVE-2022-36054 | Medium | 6.8 | 2022-09-01 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in the Contiki-NG operating system (f… |
CVE-2022-36053 | Medium | 5.9 | 2022-09-01 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The low-power IPv6 network stack of Contiki-NG has a buffer modu… |
CVE-2022-36052 | Medium | 5.9 | 2022-09-01 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in Contiki-NG may cast a UDP header s… |
CVE-2022-35927 | High | 8.1 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating s… |
CVE-2022-35926 | Medium | 5.9 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki… |
CVE-2021-32771 | High | 8.1 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an I… |
CVE-2020-12140 | High | 8.8 | 2021-12-07 | A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP… |
CVE-2020-12141 | Critical | 9.1 | 2021-10-19 | An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclose information via… |
CVE-2021-21410 | High | 8.2 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be triggered by 6LoWPAN packets sent t… |
CVE-2021-21281 | High | 7.0 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Contiki-NG versions pri… |
CVE-2021-21280 | High | 8.6 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write in versions of Con… |
CVE-2021-21279 | High | 7.5 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perform a denial-of-serv… |
CVE-2021-21257 | High | 8.2 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations in the Contiki-NG op… |
CVE-2021-21282 | High | 8.6 | 2021-06-18 | Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In versions prior to 4.5, buffer overflow can be triggered by an… |
CVE-2020-24335 | High | 7.5 | 2021-02-02 | An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker to corrupt memory… |
CVE-2020-24336 | Critical | 9.8 | 2020-12-11 | An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify wheth… |
CVE-2020-24334 | High | 8.2 | 2020-12-11 | The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the number of responses specified in the DN… |
CVE-2020-13988 | High | 7.5 | 2020-12-11 | An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packe… |
CVE-2020-14936 | Critical | 9.8 | 2020-08-18 | Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP agent. Functions parsing the OIDs in SNMP requests lack sufficient allocated target… |
CVE-2020-14935 | Critical | 9.8 | 2020-08-18 | Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP bulk get request response encoding function. The function parsing the received SNMP… |
CVE-2020-14934 | Critical | 9.8 | 2020-08-18 | Buffer overflows were discovered in Contiki-NG 4.4 through 4.5, in the SNMP agent. The function parsing the received SNMP request does not verify the input mes… |
CVE-2020-14937 | Critical | 9.1 | 2020-08-18 | Memory access out of buffer boundaries issues was discovered in Contiki-NG 4.4 through 4.5, in the SNMP BER encoder/decoder. The length of provided input/outpu… |
CVE-2019-9183 | High | 7.5 | 2020-04-23 | An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment pro… |
CVE-2019-8359 | Critical | 9.8 | 2020-04-23 | An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. An out of bounds write is present in the data section during 6LoWPAN fragment re-ass… |
CVE-2018-19417 | Critical | 10.0 | 2018-11-21 | An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length… |
CVE-2018-1000804 | Critical | 9.8 | 2018-10-08 | contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote C… |
CVE-2018-16667 | High | 7.0 | 2018-09-07 | An issue was discovered in Contiki-NG through 4.1. There is a buffer over-read in lookup in os/storage/antelope/lvm.c while parsing AQL (lvm_register_variable… |
CVE-2018-16666 | High | 7.8 | 2018-09-07 | An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in next_string in os/storage/antelope/aql-lexer.c while parsing AQL (… |
CVE-2018-16665 | Medium | 6.1 | 2018-09-07 | An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operator in os/storage/antelope/lvm.c. |
CVE-2018-16664 | High | 7.0 | 2018-09-07 | An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow in lvm_set_type in os/storage/antelope/lvm.c while parsing AQL (lvm_set_op, lvm_s… |
CVE-2018-16663 | High | 7.8 | 2018-09-07 | An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/storage/antelope/aql-parser.c while parsing… |