What’s Vulnerable › Vulnerabilities

CVE-2026-107838: RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-09 · updated 2026-10-16
• Weakness: CWE-252

Description

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu->payload_len > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.

Affected products

• RIOT-OS RIOT: from 2023.07, <= 2026.07

References

• https://github.com/RIOT-OS/RIOT/commit/d3a47289c58d108575a19e623e4d3f647659e743
• https://github.com/RIOT-OS/RIOT/pull/22745
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-39j3-3v73-5mj2

Get alerted when CVE-2026-107838 or the next vulnerability affects your stack