CVE-2026-107838 in RIOT
Summary
by MITRE • 10/09/2026
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu->payload_len > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in RIOT operating system versions 2023.07 through 2026.07 represents a critical logic error within the nanocoap_fileserver module, specifically located in sys/net/application_layer/nanocoap/fileserver.c. This open-source microcontroller OS is widely deployed in Internet of Things devices and embedded systems where resource constraints are significant. The core flaw stems from improper handling of return values during the CoAP response construction process. When a remote client initiates a request, the system attempts to initialize the response structure via _resp_init(). If this initialization fails due to buffer limitations or other internal errors, the calling functions such as _get_file() or _get_directory() do not abort execution. Instead, they proceed with stale and potentially corrupted response state data. This lack of defensive programming allows malformed processing paths to continue despite prior failures in critical setup phases.
The attack vector involves a remote client sending a CoAP request containing a sufficiently large extended token when the nanocoap_token_ext feature is enabled. The presence of this oversized token contributes to conditions where coap_build_reply() cannot fit the response header into the allocated buffer, leading to the failure of _resp_init(). Because the subsequent file or directory retrieval functions ignore this failure indicator, they attempt to process data based on invalid assumptions about the state of the CoAP Protocol Data Unit. This logical flaw bypasses standard error handling mechanisms that are essential for maintaining system integrity in constrained environments. The attacker does not need authentication if the service is exposed, making it a remote exploitable vulnerability without physical access or prior credentials.
The operational impact of this vulnerability manifests as a denial of service condition affecting both the specific network service and potentially the entire device task running RIOT. As the flawed execution path continues, it eventually reaches _calc_szx2(), where an assertion check verifies that pdu->payload_len is greater than reserve. Since the response state was initialized incorrectly or left in a stale configuration due to the ignored error from _resp_init(), this condition fails. The resulting assertion failure terminates the affected service thread or crashes the device task entirely. For embedded devices running RIOT, such as smart home sensors or industrial controllers, this can lead to complete unavailability of the node until it is manually reset or rebooted, disrupting dependent systems and potentially causing data loss if state was not persisted safely before termination.
From a classification perspective, this vulnerability aligns with CWE-252 unchecked return value, where the software does not check for errors from functions that may indicate failure conditions. It also relates to CWE-486 comparison of class for identity or CWE-369 race condition if stale state leads to inconsistent data handling, though primarily it is a logic error in control flow following an API misuse. In terms of MITRE ATT&CK mapping, this falls under T1499 Endpoint Denial of Service, specifically utilizing resource exhaustion via malformed input that triggers internal assertion failures leading to process termination. The vulnerability highlights the risks associated with enabling extended features like nanocoap_token_ext without rigorous validation of all intermediate steps in the packet processing pipeline.
Mitigation strategies for this issue involve immediate code review and patching within the affected RIOT versions. Developers must ensure that _resp_init() return values are strictly checked, and any failure should result in an early exit from the request handling function to prevent further processing with invalid state. Implementing robust error propagation mechanisms is essential to maintain system stability. Until a fixed release is available, administrators can mitigate risk by disabling nanocoap_token_ext if extended tokens are not required for their specific use case. Additionally, deploying network-level access controls such as firewalls or ACLs to restrict CoAP traffic to trusted sources only can reduce the attack surface. Monitoring device logs for assertion failures and implementing watchdog timers that automatically reboot devices after crashes can help restore availability more quickly in production environments where immediate patching is not feasible.