CVE-2020-17440

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain name bytes in DNS response packets when a name lacks this termination, and eventually leads to dereferencing the pointer at an invalid/arbitrary address, within newdata() and parse_name() in resolv.c.

• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17435This vulnerability allows remote attackers to disclose sensi…7.8
• CVE-2020-17436This vulnerability allows remote attackers to disclose sensi…7.8
• CVE-2020-17437An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…8.2
• CVE-2020-17438An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…9.8
• CVE-2020-17439An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…8.3
• CVE-2020-1744A flaw was found in keycloak before version 9.0.1. When conf…5.6
• CVE-2020-17441An issue was discovered in picoTCP 1.7.0. The code for proce…9.1
• CVE-2020-17442An issue was discovered in picoTCP 1.7.0. The code for parsi…7.5
• CVE-2020-17443An issue was discovered in picoTCP 1.7.0. The code for creat…7.5
• CVE-2020-17444An issue was discovered in picoTCP 1.7.0. The routine for pr…7.5
• CVE-2020-17445An issue was discovered in picoTCP 1.7.0. The code for proce…7.5
• CVE-2020-17446asyncpg before 0.21.0 allows a malicious PostgreSQL server t…9.8