{"id":"CVE-2026-107838","summary":"RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion","details":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu-\u003epayload_len \u003e reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.","aliases":["GHSA-39j3-3v73-5mj2"],"modified":"2026-10-11T07:05:49.501327028Z","published":"2026-10-09T17:55:34.670Z","database_specific":{"cwe_ids":["CWE-252","CWE-617"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107838.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107838.json"},{"type":"ADVISORY","url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-39j3-3v73-5mj2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107838"},{"type":"FIX","url":"https://github.com/RIOT-OS/RIOT/commit/d3a47289c58d108575a19e623e4d3f647659e743"},{"type":"FIX","url":"https://github.com/RIOT-OS/RIOT/pull/22745"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/riot-os/riot","events":[{"introduced":"985a38cd09e9532b82dc77c4109da66304c5adb8"},{"fixed":"a897b0498f635654f091bf9f33e9696aa773e886"},{"fixed":"d3a47289c58d108575a19e623e4d3f647659e743"}],"database_specific":{"extracted_events":[{"introduced":"2023.07"},{"fixed":"2026.07"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["2026.04-devel","2026.01-RC1","2026.01-devel","2025.10-RC1","2025.10-devel","2025.07-RC1","2025.07-devel","2025.04-RC1","2025.04-devel","2025.01-RC1","2025.01-devel","2024.10-RC1","2024.10-devel","2024.07-RC1","2024.04","2024.07-devel","2024.04-RC1","2024.04-devel","2024.01-RC1","2024.01-devel","2023.10-RC1","2023.10-devel","2023.07-RC1","2023.07-devel","2023.04-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107838.json","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/d3a47289c58d108575a19e623e4d3f647659e743","target":{"file":"sys/net/application_layer/nanocoap/fileserver.c"},"deprecated":false,"digest":{"line_hashes":["171507221497450670567383896486461591823","184222878039072624379591828366831829964","244529858853978079423892502861736251244","229861985934956762961893705134281501212","99991400939048286714452585311656272165","20982551879899120631395534511945575343","36445335840178027683593728941929430566","57603119724233125385704002323619310573","158265367178564601914102126394761431642","61875553451868952054840311218476251695","247955484745545944234616396512263699995","164995089561970739279645862456886029896","272459023698889316599739721912149776267","123779484895205659669835385967820346918","116824370878028326268113191768354416517","255715907276742379817709658708132878388","79614774512381930966131092153987254225","146766668663944246413124398172786046504","61586085463865408319706340935638508243","55105503275451565111573641831781919354","212607372852184917526116510251012259399","283591168067188050408647847092204416066","55196908150625645248921882282857822065","44244223599788185734379947159049266752","221221649292275267084490068584598578441","33879318618965827059104423991556080247","13152017990115001845208375755953965654","246191985437730745066658114537660807138","218016648420088833521623090492194545058","209157724021466752027725639418832171574","110134655871889370691933888045416497473","43367216457861263520870247183542063936","325607893680895168219806812952758365252","158230864287806813985469762761555400627","61586085463865408319706340935638508243","55105503275451565111573641831781919354"],"threshold":0.9},"id":"CVE-2026-107838-031515e5"},{"target":{"function":"_put_directory","file":"sys/net/application_layer/nanocoap/fileserver.c"},"deprecated":false,"digest":{"function_hash":"410120153769142573750678630796507626","length":757},"id":"CVE-2026-107838-0aca4b32","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/d3a47289c58d108575a19e623e4d3f647659e743"},{"source":"https://github.com/riot-os/riot/commit/d3a47289c58d108575a19e623e4d3f647659e743","target":{"file":"sys/net/application_layer/nanocoap/fileserver.c","function":"_delete_file"},"deprecated":false,"digest":{"length":790,"function_hash":"197246149766307422549953924345109508386"},"id":"CVE-2026-107838-16aa3e67","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"251533180506767637427407042197260998372","length":2359},"id":"CVE-2026-107838-7d668125","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/d3a47289c58d108575a19e623e4d3f647659e743","target":{"file":"sys/net/application_layer/nanocoap/fileserver.c","function":"_get_file"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"184441348458783064992535294274914401886","length":1871},"id":"CVE-2026-107838-bf06ad21","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/d3a47289c58d108575a19e623e4d3f647659e743","target":{"function":"_get_directory","file":"sys/net/application_layer/nanocoap/fileserver.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/d3a47289c58d108575a19e623e4d3f647659e743","target":{"file":"sys/net/application_layer/nanocoap/fileserver.c","function":"_put_file"},"deprecated":false,"digest":{"length":2928,"function_hash":"265169051995314361809539259181108406848"},"id":"CVE-2026-107838-de28f12e"},{"target":{"file":"sys/net/application_layer/nanocoap/fileserver.c","function":"_delete_directory"},"deprecated":false,"digest":{"function_hash":"158857300323127895846261340431503356777","length":764},"id":"CVE-2026-107838-e82b5707","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/d3a47289c58d108575a19e623e4d3f647659e743"}],"vanir_signatures_modified":"2026-10-11T07:05:49Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}