CVE-2023-50927 is a high severity set of out of bounds reads in the RPL-Lite implementation of Contiki-NG, scored 8.6. DIO and DAO messages with sub option headers are not length checked. Upgrade to Contiki-NG 4.9, or apply pull request 2484 if you cannot upgrade.
What's affected
The GitHub advisory lists Contiki-NG releases before 4.9, in the RPL-Lite package, as affected. It names 4.9 as the patched version. Users who cannot upgrade should manually apply the changes in pull request 2484.
The sources differ on severity. The advisory rates it Moderate, while NVD scores it 8.6 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The changed scope in the vector reflects that a fault in a network node can affect the wider network. The record was published on 2024-02-14.
The cause is insufficient control of the lengths in DIO and DAO messages, particularly when they contain RPL sub option headers. This is a separate flaw from CVE-2023-50926, which concerns the prefix length and is listed as still affecting 4.9.
How to check if you're exposed
Look at which Contiki-NG version your firmware is built on, and whether routing uses RPL-Lite:
git -C contiki-ng describe --tags
Anything before 4.9 should be updated. As embedded builds usually copy the operating system into the project, check your own repository.
If you run networks of constrained devices, note which are on the same radio segment, since a single faulty node can disturb routing for its neighbors and the border router.
What to do now
- Identify the Contiki-NG version in each product.
- Upgrade to 4.9 or later, or apply pull request 2484.
- Check the separate CVE-2023-50926 fix, which 4.9 does not include.
- Rebuild and deploy new firmware images.
- Limit which nodes can join or speak on the routing network.
Why it matters
The weakness is an out of bounds read, CWE-125. Message parsers in constrained operating systems have little room for error: no memory protection means a bad read can fault the whole device.
RPL is the routing protocol for low power and lossy networks. A node that processes routing messages from any neighbor trusts packets before it knows much about the sender, so length checks matter.
The record shows no CISA Known Exploited Vulnerabilities listing, and the advisory does not report exploitation in the wild.
Quick check
Which release fixes CVE-2023-50927?
Contiki-NG 4.9. Releases before 4.9 are affected.
Does 4.9 fix the related CVE-2023-50926?
No. That advisory lists 4.9 and earlier as affected, with the fix in the develop branch.
Sources
Last reviewed: 19 October 2026.
