{"id":"CVE-2026-107836","summary":"RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size","details":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx-\u003eoffset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.","aliases":["GHSA-x924-p5fq-26pc"],"modified":"2026-10-11T07:04:31.320343492Z","published":"2026-10-09T17:49:41.120Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107836.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-191"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107836.json"},{"type":"ADVISORY","url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-x924-p5fq-26pc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107836"},{"type":"FIX","url":"https://github.com/RIOT-OS/RIOT/commit/49b894cbe091510093273b98d92c4a17167d6839"},{"type":"FIX","url":"https://github.com/RIOT-OS/RIOT/pull/22518"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/riot-os/riot","events":[{"introduced":"0"},{"fixed":"49b894cbe091510093273b98d92c4a17167d6839"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"last_affected":"2026.07"}]}}],"versions":["2026.10-devel","2026.07-RC1","2026.07-devel","2026.04-RC1","2026.04-devel","2026.01-RC1","2026.01-devel","2025.10-RC1","2025.10-devel","2025.07-RC1","2025.07-devel","2025.04-RC1","2025.04-devel","2025.01-RC1","2025.01-devel","2024.10-RC1","2024.10-devel","2024.07-RC1","2024.04","2024.07-devel","2024.04-RC1","2024.04-devel","2024.01-RC1","2024.01-devel","2023.10-RC1","2023.10-devel","2023.07-RC1","2023.07-devel","2023.04-RC1","2023.04-devel","2023.01-RC1","2023.01-devel","2022.10-RC1","2022.10-devel","2022.07-RC1","2022.07-devel","2022.04-RC1","2022.04-devel","2022.01-RC1","2022.01-devel","2021.10-RC1","2021.10-devel","2021.07-RC1","2021.07-devel","2021.04-RC1","2021.04-devel","2021.01-RC1","2021.01-devel","2020.10-RC1","2020.10-devel","2020.07-RC1","2020.07-devel","2020.04-RC1","2020.04-devel","2020.01-RC1","2020.01-devel","2019.10-RC1","2019.10-devel","2019.07-RC1","2019.07-devel","2019.04-RC1","2019.04-devel","2019.01-RC1","2018.10-devel","2018.07-RC1","2019.01-devel","2018.10-RC1","2018.07-devel","2018.04-RC1","2018.04-devel","2018.01-RC1","2018.01-devel","2017.10-RC1","2017.10-devel","2017.07-RC1","2017.07-devel","2017.04-RC1","2017.04-devel","2017.01-RC1","2017.01-devel","2016.10-RC1","2016.10-devel","2016.07-RC2","2016.07-RC1","2016.04-RC1","2016.07-devel","2016.03-devel","2015.12-RC1","2015.12-devel","2015.09-RC1","2014.12","2014.05","2014.01","2013.08"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"76832064733234223193889783773101696529","length":672},"id":"CVE-2026-107836-13fe178f","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"file":"sys/net/application_layer/nanocoap/sock.c","function":"_fetch_block"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"file":"sys/net/application_layer/nanocoap/sock.c","function":"_sock_put_post"},"deprecated":false,"digest":{"function_hash":"255707098787864809096830836544856557948","length":787},"id":"CVE-2026-107836-29727bd6"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"function":"nanocoap_sock_get_blockwise","file":"sys/net/application_layer/nanocoap/sock.c"},"deprecated":false,"digest":{"length":719,"function_hash":"149845049140918104330384932862143665317"},"id":"CVE-2026-107836-2d52f4be"},{"id":"CVE-2026-107836-4e9e0ff6","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"function":"_2buf_slice","file":"sys/net/application_layer/nanocoap/sock.c"},"deprecated":false,"digest":{"function_hash":"107060447268449598051203092730318965964","length":671}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["169307500721701795328167298831746478115","295813158917240658445462817112507531306","70288771015992134253538214855103023065","256501501910729510956192158878798513528","290987677943873628050217538758500080365","146464223189677111633665925912530068787","220630893023653420725311973201143020555","174025352075009688741592005007649379555","129846494621987890911962146877569562995","65578302141134160275502275780075088421","246122926145765156370627238266871215039","29467998943012179824531010738466108886","185702398328951276323667114973314182927","314008236201920016900435549384158847954","147988792297222117436602425349423514192","135468080122925054154753380586208758586","164481126637224253901722643311673212430","28843870287703352007323832771819314855","98255939287550298175350561578881052433","200589526362494021811525883746822272587","72210402405461877696331843357600195898","150536774297523689623693991939340239948","115423411495203227984565374759383591465","95222390496266571061662931039789667857","57804281429765240967896370874107983054","113613595562391133147105732986185828453","322284466354888577704557657927196194955","18781658228984464448702699001656964983","156597293347297530133196289645339958288","260169711633259319629583815711142948090","242608183247151291059601793571167979787","60626535628462523899435919968986402837","338682449116260469039519694793437800352","127292745121795461261084280665605374553","132388207646262627170634496609993988475","232409775669185390970236848950048828780","147335555943979592833837574655334462380","5089442158679376519720253578641146923","242821038516716124431405340289035681501","79499618660302000015165511457450026026","23636894043270507664130809120541539787","323430006121972890116731670258801727554","229326906349322318734711603410967798096","234819603444859403141878035844713406239","125272147372771691877914159237048314333","334223952400737275889289111834476543880","227530151032414813527836431143583976431","57793687832104706673244646403175100382","303759081711761690989103555005828269868","334932541731437577474444178714354017369","51873931305736818689011146776790997016","5530409680382448874441778104088658951","158606965819553659988828297129399537977","39485832915025538572737586149668147192","190196350811436578764017375214193548242","171154620143817178597344822263554734941","128274118073857619592390786964730451938","143391578266497546863458293123842537238","182438523868276184021416270543498717715","53889555703544458596860605247743870326","167295998055282435918198225905340355709","317039130943411275819438502804587418224","208232089401901849257744667454295624337","118906997162566598531539434225608172568","254195116676599755927907214719986446950","143388747882243604857828002525856070437","245069331536060554941358180978912803745","69252600006432688474143489084673510696","138382779464015936532712017456877092397","325990180184709158870760939198345034772","310201233606007586335520475463029470102","153754813680607111801991983552109288173","227248631653825647728541685210775803313","87134079801186655041343067124061669370","73235295809668203741569863984323531473","242982669542774924485398390887367112797","304711255625486478861655066895156115884","227979108173449540504595999446761383996","315989031401831377941639943149703197280","141463475992836853175353024763485156010","149422235227181097113648563326858547272","48552288184317023787715308594143955650","271746089092457117253499979009439092210","279748349831216791419710037904065116872","310467125742481114144168920990057928044","63957061269164737383151169185630894833","143755424129503886478981935253263813710","325532602970920509124608446643977457649","206479150142858281693472167105917696289","120659994793730298859289623935122174574","135296685360721423352428486092986047790","193923486222099153191013862170784074385","143693328639123020046371474773011904972","298327140482529955835602169681131290949","102745491324833659592118464552874349098","158606965819553659988828297129399537977","293887006632446462021732543381189835875","331450156502215059271840217126742280945","111810843589874174062346952241837809158","112893554872358120537350086012865230761","128274118073857619592390786964730451938","143391578266497546863458293123842537238","182438523868276184021416270543498717715","53889555703544458596860605247743870326","167295998055282435918198225905340355709","317039130943411275819438502804587418224","208232089401901849257744667454295624337","118906997162566598531539434225608172568","269336952215750429481230206750852950816"]},"id":"CVE-2026-107836-6d5a9292","signature_type":"Line","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"file":"sys/net/application_layer/nanocoap/sock.c"}},{"source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"function":"nanocoap_sock_get_slice","file":"sys/net/application_layer/nanocoap/sock.c"},"deprecated":false,"digest":{"function_hash":"85576472473844659981495769844718779669","length":1035},"id":"CVE-2026-107836-d53280a1","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["86655763879694701067059363373943424872","52983483485435362535563710308056867620","83814966440024713590605234216942936858","176782073988666981597286985393780243225","272476517447821318251507201679314108142","207106696261093784596848394233525082443","261913128923142119564828157008697152867","248008639538615087286692725592895037861","289707576713756604315005171446649257861","72033815380575572653759745585185772079","13931619124233481876713985926503381734","176471574168916367415382125590624165505","21889805689210607826657557803394529488"],"threshold":0.9},"id":"CVE-2026-107836-e01f07e3","signature_type":"Line","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"file":"sys/include/net/nanocoap_sock.h"}},{"digest":{"function_hash":"133940198885908497024920368892225783280","length":542},"id":"CVE-2026-107836-ffe08410","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/49b894cbe091510093273b98d92c4a17167d6839","target":{"file":"sys/net/application_layer/nanocoap/sock.c","function":"_block_cb"},"deprecated":false}],"vanir_signatures_modified":"2026-10-11T07:04:31Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107836.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}