CVE-2026-107836: RIOT OS nanoCoAP Client DOS Vulnerability

CVE-2026-107836 Overview

CVE-2026-107836 affects RIOT, an open-source microcontroller operating system for Internet of Things (IoT) devices and embedded systems. The vulnerability resides in the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c. The _block_cb() callback accepts a Block2 response based only on the expected block number, without verifying that the server-controlled szx (block size exponent) and derived offset match the requested block geometry. A malicious Constrained Application Protocol (CoAP) server can trigger an integer underflow in _2buf_slice(), causing an out-of-bounds read before the payload buffer. The flaw affects RIOT version 2026.07 and earlier, and no fixed release is available as of this review.

Critical Impact
A malicious CoAP server can crash RIOT-based IoT clients and potentially expose adjacent memory contents through an out-of-bounds read [CWE-125].

Affected Products

RIOT OS version 2026.07
RIOT OS versions prior to 2026.07
Embedded and IoT devices using the nanocoap_sock_get_slice() client function

Discovery Timeline

2026-10-09 - CVE-2026-107836 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107836

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in RIOT's nanoCoAP blockwise transfer client. CoAP Block2 responses carry three server-controlled values: block number (NUM), more flag (M), and block size exponent (szx). The client is expected to validate all three against its request. In the vulnerable code path, _block_cb() validates only the block number. The attacker-chosen szx is accepted as-is and used to derive the payload offset for _2buf_slice().

When the server returns the expected block number but with a larger szx, the derived offset exceeds the client's slice offset. The subsequent ctx->offset - offset subtraction underflows because both values are unsigned. The resulting large value is used as a buffer-relative index, producing a read before the start of the payload buffer. The read crashes the client and may disclose adjacent stack or heap memory.

Root Cause

The root cause is missing server-input validation in the Block2 response handler. The client trusts the server-supplied block size exponent without checking that it matches the geometry negotiated in the request. Combined with unsigned arithmetic in _2buf_slice(), the missing check converts a protocol-level mismatch into a buffer-relative underflow.

Attack Vector

Exploitation requires a RIOT client to issue a nanocoap_sock_get_slice() request to an attacker-controlled or attacker-influenced CoAP server. The server responds with a Block2 option carrying the expected block number but a larger szx value. User interaction, in the form of initiating or accepting the CoAP exchange, is required. The attack is reachable over the network without authentication.

 // Patch excerpt: sys/include/net/nanocoap_sock.h
 #include <stdint.h>
 #include <unistd.h>
 
-#include "random.h"
+#include "event/thread.h"
 #include "net/nanocoap.h"
 #include "net/sock/udp.h"
 #include "net/sock/util.h"
+#include "random.h"
+
 #if IS_USED(MODULE_NANOCOAP_DTLS)
-#include "net/credman.h"
-#include "net/sock/dtls.h"
+#  include "net/credman.h"
+#  include "net/sock/dtls.h"
 #endif

Source: GitHub Commit 49b894c. The commit 49b894c restructures nanoCoAP sock headers and adjusts blockwise transfer handling as part of the ongoing fix.

Detection Methods for CVE-2026-107836

Indicators of Compromise

Unexpected crashes or resets of RIOT-based IoT devices during or immediately after CoAP GET exchanges using blockwise transfer.
CoAP Block2 responses whose szx field does not match the szx sent by the client in the matching request.
Memory fault logs or panic traces referencing _2buf_slice() or nanocoap_sock_get_slice().

Detection Strategies

Inspect CoAP traffic on UDP port 5683 (and DTLS-protected 5684) for Block2 responses with a szx value larger than the client-requested value.
Correlate device reboot or watchdog events with CoAP sessions terminated by a server response rather than by the client.
Review firmware builds for inclusion of nanocoap_sock_get_slice() from RIOT 2026.07 or earlier.

Monitoring Recommendations

Log CoAP request and response pairs at the gateway and alert on block-size mismatches between request and response.
Monitor outbound CoAP destinations from IoT fleets and restrict them to known-good servers.
Track crash telemetry from embedded devices and surface clusters that correlate with specific CoAP peers.

How to Mitigate CVE-2026-107836

Immediate Actions Required

Inventory all RIOT-based devices and identify firmware images that use nanocoap_sock_get_slice().
Restrict RIOT CoAP clients to trusted servers using network segmentation or allowlists on upstream gateways.
Disable blockwise GET operations in affected applications where feasible until a patched release is available.

Patch Information

No fixed RIOT release is available as of this review. Remediation work is tracked in GitHub Pull Request #22518 and GitHub Commit 49b894c. Full advisory details are in GitHub Security Advisory GHSA-x924-p5fq-26pc. Operators building firmware from source can apply the referenced commit as an interim fix after validating against their application.

Workarounds

Route CoAP client traffic through a validating proxy that drops Block2 responses whose szx exceeds the requested value.
Enforce DTLS with mutual authentication (MODULE_NANOCOAP_DTLS) so clients only accept Block2 responses from authenticated servers.
Where application logic allows, retrieve resources using single-block CoAP GET rather than blockwise transfers.

bash

# Example gateway rule: block CoAP responses from untrusted peers
iptables -A FORWARD -p udp --sport 5683 -s 0.0.0.0/0 -j DROP
iptables -A FORWARD -p udp --sport 5683 -s 10.0.0.0/8 -j ACCEPT