CVE-2021-28362

An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incoming IPv6 packet, there is an attempt to remove the RPL extension headers. Because the packet length and the extension header length are unchecked (with respect to the available data) at this stage, and these variables are susceptible to integer underflow, it is possible to construct an invalid extension header that will cause memory corruption issues and lead to a Denial-of-Service condition. This is related to rpl-ext-header.c.

• CWE-191

• https://github.com/contiki-os/contiki/releasesRelease Notes, Third Party Advisory
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
• https://github.com/contiki-os/contiki/releasesRelease Notes, Third Party Advisory
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource

Published

Mar 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28355Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28356Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28357Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28358Remote Procedure Call Runtime Remote Code Execution Vulnerab…8.8
• CVE-2021-28359The "origin" parameter passed to some of the endpoints like …6.1
• CVE-2021-28361An issue was discovered in Storage Performance Development K…7.5
• CVE-2021-28363The urllib3 library 1.26.x before 1.26.4 for Python omits SS…6.5
• CVE-2021-28372ThroughTek's Kalay Platform 2.0 network allows an attacker t…8.3
• CVE-2021-28373The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) befor…7.5
• CVE-2021-28374The Debian courier-authlib package before 0.71.1-2 for Couri…7.5
• CVE-2021-28375An issue was discovered in the Linux kernel through 5.11.6. …7.8
• CVE-2021-28376ChronoForms 7.0.7 allows fname Directory Traversal to read a…2.7