CVE-2023-50926 is a high severity out of bounds read in the RPL-Lite routing code of Contiki-NG, scored 7.5. A DIO message with an unchecked prefix length triggers it. The advisory lists no patched release, so apply the changes from pull request 2721 or the develop branch.
What's affected
The GitHub advisory lists Contiki-NG 4.9 and earlier, in the RPL-Lite package at os/net/routing/rpl-lite, as affected. It lists no patched version: the fix is in the develop branch and expected in the next release. The workaround is to apply pull request 2721.
The sources differ on severity. The advisory rates it Moderate, while NVD scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The record was published on 2024-02-14.
The cause is a prefix length field in the DIO message that is not validated. A value longer than the maximum prefix length can cause a memcmp call to read past the end of the array that holds the prefix. The sources describe a read, not a write, so the impact is mainly on availability.
Note that 4.9, the release that fixed the related CVE-2023-50927, is still listed as affected here.
How to check if you're exposed
Check which Contiki-NG release your firmware is built from and whether you use RPL-Lite:
git -C contiki-ng describe --tags
grep -r "ROUTING" project-conf.h Makefile
Embedded projects often vendor a copy of the operating system, so look at your own source tree and not at a system package. If your build selects RPL-Lite as the routing protocol, the code is present.
Then check whether your branch already includes the change from pull request 2721.
What to do now
- Find the products in your fleet built on Contiki-NG and their versions.
- Confirm whether the build uses RPL-Lite routing.
- Apply the changes from pull request 2721, or update to a release that includes them once published.
- Rebuild and roll out firmware images to devices.
- Segment low power networks so untrusted nodes cannot send routing messages.
Why it matters
The weakness is an out of bounds read, CWE-125. The code trusts a length field from a network message and uses it to compare memory. A longer value than the buffer allows reads data beyond the array.
In constrained devices a bad read can crash the node or disrupt the mesh. Routing protocol messages are processed without authentication in many low power networks, so any device in radio range can send them.
The record shows no CISA Known Exploited Vulnerabilities listing, and the advisory does not report exploitation in the wild.
Quick check
Is there a fixed release?
Not yet listed. The advisory says the fix is in the develop branch and recommends pull request 2721.
Why does the severity differ?
The advisory calls it Moderate and NVD scores it 7.5 High. Use the higher score for prioritization.
Sources
Last reviewed: 19 October 2026.
