CVE-2026-107838: RIOT Operating System DoS Vulnerability

CVE-2026-107838 Overview

CVE-2026-107838 affects RIOT, an open-source microcontroller operating system for Internet of Things (IoT) devices and embedded systems. The vulnerability resides in the nanocoap_fileserver component located at sys/net/application_layer/nanocoap/fileserver.c. Callers ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote attacker can send a crafted Constrained Application Protocol (CoAP) request with a sufficiently large extended token to trigger an assertion failure, terminating the affected service or device task. The flaw is tracked under [CWE-252: Unchecked Return Value].

Critical Impact
Unauthenticated remote attackers can crash RIOT devices running nanocoap_fileserver with nanocoap_token_ext enabled, causing denial of service on IoT and embedded systems.

Affected Products

RIOT OS versions 2023.07 through 2026.07
Devices running nanocoap_fileserver with nanocoap_token_ext enabled
IoT and embedded systems built on vulnerable RIOT releases

Discovery Timeline

2026-10-09 - CVE-2026-107838 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107838

Vulnerability Analysis

The flaw is a denial-of-service condition caused by an unchecked return value in RIOT's nanocoap_fileserver implementation. When coap_build_reply() cannot fit a response header into the response buffer, _resp_init() returns a failure code. Callers in fileserver.c ignore this failure, allowing _get_file() and _get_directory() to continue operating on stale response state. Execution then reaches _calc_szx2() where the assertion pdu->payload_len > reserve fires. The resulting assertion failure terminates the affected service or device task. The condition requires no authentication and no user interaction, and it can be triggered over the network.

Root Cause

The root cause is improper error handling [CWE-252]. The _resp_init() function signals buffer-fit failures through its return value, but callers invoke it without inspecting the result. This breaks the invariants that downstream functions depend on, producing an inconsistent protocol data unit (PDU) state that violates runtime assertions.

Attack Vector

An unauthenticated remote attacker sends a CoAP request containing an extended token large enough that coap_build_reply() cannot fit the response header into the available buffer. The feature nanocoap_token_ext must be enabled on the target. Response initialization fails silently, request handling proceeds with stale state, and the assertion in _calc_szx2() terminates the service.

     }
     if (request->options.exists.etag &&
         !memcmp(&etag, &request->options.etag, sizeof(etag))) {
-        _resp_init(pdu, buf, len, COAP_CODE_VALID);
+        if (_resp_init(pdu, buf, len, COAP_CODE_VALID)) {
+            return -1;
+        }
         coap_opt_add_opaque(pdu, COAP_OPT_ETAG, &etag, sizeof(etag));
         return coap_opt_finish(pdu, COAP_OPT_FINISH_NONE);
     }

Source: RIOT-OS Commit d3a47289. The patch adds explicit checks on _resp_init() return values so callers return early rather than continuing with invalid response state.

Detection Methods for CVE-2026-107838

Indicators of Compromise

Unexpected termination or restart of RIOT device tasks hosting nanocoap_fileserver
Inbound CoAP requests containing abnormally large extended tokens targeting UDP port 5683
Device logs showing assertion failures referencing _calc_szx2() or pdu->payload_len > reserve

Detection Strategies

Inspect CoAP traffic at network boundaries for requests with oversized token lengths exceeding typical values
Correlate repeated device reboots or watchdog resets with inbound CoAP activity from the same source
Monitor firmware crash telemetry for assertion failures originating in nanocoap/fileserver.c

Monitoring Recommendations

Deploy network sensors capable of parsing CoAP headers to flag malformed or extended-token requests
Centralize IoT device uptime and crash metrics to detect clustered denial-of-service events
Alert on sudden drops in CoAP service availability across fleets of RIOT-based devices

How to Mitigate CVE-2026-107838

Immediate Actions Required

Inventory all RIOT-based devices running versions 2023.07 through 2026.07 that expose nanocoap_fileserver
Restrict network access to CoAP endpoints (UDP 5683) using firewall rules or network segmentation
Disable the nanocoap_token_ext build option on devices that do not require extended token support

Patch Information

No fixed release is available as of this review. The upstream fix is tracked in RIOT-OS Pull Request #22745 and commit d3a47289. Full technical details are available in GitHub Security Advisory GHSA-39j3-3v73-5mj2. Organizations building firmware from source can apply the patch directly to sys/net/application_layer/nanocoap/fileserver.c.

Workarounds

Rebuild firmware with nanocoap_token_ext disabled where extended CoAP tokens are not required
Place vulnerable devices behind a CoAP-aware proxy that enforces token length limits
Apply the upstream patch from commit d3a47289 to local RIOT source trees prior to the next official release

bash

# Example: block external CoAP traffic to IoT subnet pending patch
iptables -A FORWARD -p udp --dport 5683 -d 10.20.0.0/16 -j DROP
iptables -A FORWARD -p udp --sport 5683 -s 10.20.0.0/16 -j DROP