CVE-2026-107838 Details
Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu->payload_len > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.
A denial-of-service vulnerability has been identified in the RIOT operating system, specifically within the nanocoap_fileserver component. This issue affects versions 2023.07 through 2026.07. The vulnerability arises because the fileserver fails to properly handle errors when initializing CoAP response headers. Remote clients can exploit this by sending CoAP requests with large extended tokens, causing the response initialization to fail while the server continues processing with an invalid response state. This oversight leads to a reachable assertion in the code, terminating the affected service or device task.
As of now, no fixed release is available. However, the vulnerability can be addressed by modifying the nanocoap_fileserver code to check the return value of the response initialization function and handle errors appropriately before proceeding with request processing.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RIOT-OS/RIOT/commit/d3a47289c58d108575a19e623e4d3f647659e743 | [email protected] | Source CodeVendor |
| https://github.com/RIOT-OS/RIOT/pull/22745 | [email protected] | Source CodeVendor |
| https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-39j3-3v73-5mj2 | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-252 | Unchecked Return Value | [email protected] |
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RIOT | >= 2023.07, <= 2026.07 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |