CVE-2022-35927

Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue.

• CWE-120
• CWE-120

• https://github.com/contiki-ng/contiki-ng/pull/1589Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa957d1fd9ef321eb87d2Patch, Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9rm9-3phh-p4wmThird Party Advisory
• https://github.com/contiki-ng/contiki-ng/pull/1589Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa957d1fd9ef321eb87d2Patch, Third Party Advisory
• https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9rm9-3phh-p4wmThird Party Advisory

Published

Aug 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35921fof/byobu is a private discussions extension for Flarum foru…4.3
• CVE-2022-35922Rust-WebSocket is a WebSocket (RFC6455) library written in R…7.5
• CVE-2022-35923v8n is a javascript validation library. Versions of v8n prio…7.5
• CVE-2022-35924NextAuth.js is a complete open source authentication solutio…9.1
• CVE-2022-35925BookWyrm is a social network for tracking reading. Versions …9.8
• CVE-2022-35926Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2022-35928AES Crypt is a file encryption software for multiple platfor…5.5
• CVE-2022-35929cosign is a container signing and verification utility. In v…9.8
• CVE-2022-3593Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-35930PolicyController is a utility used to enforce supply chain p…8.8
• CVE-2022-35931Nextcloud Password Policy is an app that enables a Nextcloud…2.7
• CVE-2022-35932Nextcloud Talk is a video and audio conferencing app for Nex…5.3