CVE-2026-107838

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu->payload_len > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.

• CWE-252
• CWE-617

• https://github.com/RIOT-OS/RIOT/commit/d3a47289c58d108575a19e623e4d3f647659e743
• https://github.com/RIOT-OS/RIOT/pull/22745
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-39j3-3v73-5mj2

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107831Jivejdon through 5.0 contains a cross-site request forgery v…4.3
• CVE-2026-107833OWASP Coraza WAF is a golang modsecurity compatible web appl…5.9
• CVE-2026-107834OWASP Coraza WAF is a golang modsecurity compatible web appl…5.3
• CVE-2026-107835OWASP Coraza WAF is a golang modsecurity compatible web appl…4
• CVE-2026-107836RIOT is an open-source microcontroller operating system desi…7.1
• CVE-2026-107837RIOT is an open-source microcontroller operating system desi…8.2
• CVE-2026-107839ageLANServer provides a cross-platform web server and launch…7.5
• CVE-2026-107840yopass is a service for securely sharing secrets, passwords,…7.5
• CVE-2026-107841pacioli provides least-privilege governance and a governed a…5.7
• CVE-2026-10786Improper access control in the ticketing integration setting…6.5
• CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3
• CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaust…3.3