RIOT OS CVE-2026-107838

Requires the target to run the nanocoap_fileserver (sys/net/application_layer/nanocoap/fileserver.c) AND have the nanocoap_token_ext (CoAP extended token) feature enabled - a non-default build-time option; the attacker then sends a CoAP request with an extended token large enough that coap_build_reply() cannot fit the response header, making _resp_init() fail. LIMITING FACTORS: exploitation is gated on that non-default token-ext configuration, on the fileserver being network-reachable, and practically on RIOT assertions being compiled in (typically under DEVELHELP; NDEBUG builds may suppress the abort). No authentication is required (PR:N) and no user interaction is needed (UI:N) once those conditions hold; affected versions are 2023.07 through 2026.07 with no fixed release available.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: a remote, unauthenticated client can crash the service over the network with low complexity, and the impact is availability-only (no confidentiality or integrity loss), matching a pure denial-of-service via a reachable assertion failure (CWE-252, unchecked return value of _resp_init()). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis - the vulnerability is confirmed by a RIOT-OS GitHub Security Advisory (GHSA-39j3-3v73-5mj2) and a fix PR/commit, but no SSVC decision data was supplied. Two factors materially lower real-world risk below what the 7.5 score suggests: (1) exploitation requires the nanocoap_fileserver to be running AND the non-default nanocoap_token_ext (CoAP extended-token) feature to be enabled, and (2) the crash depends on the assertion being compiled in (RIOT assertions are typically active under DEVELHELP; production images built with NDEBUG may not abort, though stale response state could still cause undefined behavior) - these configuration dependencies are not reflected in the base CVSS and should be weighed by defenders. CONFLICTING/MISSING SIGNAL TO NOTE: the base vector marks PR:N and AC:L as if universally exploitable, but the description explicitly gates exploitation on a non-default build-time feature, so the effective attack surface is narrower than the score implies; verify whether nanocoap_token_ext is enabled in your firmware before treating this as a default-config network DoS.

An attacker with network reachability to a RIOT-based IoT device exposing the nanocoap fileserver (with nanocoap_token_ext enabled) sends a single CoAP request carrying an extended token large enough that coap_build_reply() cannot fit the response header into the buffer. _resp_init() fails but its return value is ignored, so _get_file()/_get_directory() continue with stale response state and reach the _calc_szx2() payload_len > reserve assertion, terminating the service or device task. No public exploit code is identified at time of analysis, but the trigger is a trivially crafted single packet.