Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107838— RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

Quick assessment

Affected
RIOT-OS RIOT
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RIOT 是一个面向物联网（IoT）设备及其他嵌入式系统的开源微控制器操作系统。在 2023.07 至 2026.07 版本范围内，位于 sys/net/application_layer/nanocoap/fileserver.c 中的 nanocoap_fileserver 模块存在一处漏洞：当 coap_build_reply() 无法将响应头写入响应缓冲区时，调用方会忽略 _resp_init() 返回的错误。如果启用了 nanocoap_token_ext，远程客户端可以发送一个包含足够长的扩展令牌（ex

CVSS 7.5 · High EPSS 0.34% · P25

Affected Version Matrix 1

VendorProduct Version RangeStatus
RIOT-OS RIOT >= 2023.07, <= 2026.07 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107838

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion
Source: CVE Program / CVE List V5
Vulnerability Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu->payload_len > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加检查的返回值
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
RIOT-OS RIOT >= 2023.07, <= 2026.07 -

II. Public POCs for CVE-2026-107838

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107838

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-107838 (2)

Vendor Advisories for CVE-2026-107838 (1)

Same Patch Batch · RIOT-OS · 2026-10-09 · 3 CVEs total

CVE-2026-107837 8.2 HIGH RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling
CVE-2026-107836 7.1 HIGH RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled b

IV. Related Vulnerabilities

Same product: RIOT
Same vendor: RIOT-OS
Same weakness: CWE-252

V. Comments for CVE-2026-107838

No comments yet

Leave a comment