# CVE-2026-107838: RIOT nanocoap_fileserver assertion failure in response handling

Source: https://junglewise.ai/threats/cve-2026-107838-riot-is-an-open-source-microcontroller-operating-system-designed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107838 · Severity: high · CVSS 7.5 · Published 2026-10-09

RIOT is an open-source operating system for embedded IoT microcontrollers. A remote attacker can craft a malicious CoAP request with a large token to trigger a failed response initialization, causing the affected service or device to crash and become unavailable. This can disrupt deployed IoT systems relying on RIOT.

Technologies: [Riot-Os Riot](https://junglewise.ai/threats/technologies/riot). Vendors: [Riot-Os](https://junglewise.ai/threats/vendors/riot-os).

## Quick answers

**Is CVE-2026-107838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107838 being exploited in the wild.

**How severe is CVE-2026-107838?** High severity, with a CVSS score of 7.5, published 9 October 2026.

**Which products and versions are affected?** Riot-Os Riot 2023.07 through 2026.07.

**Is there a fix for CVE-2026-107838?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107838 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-107838?** Check whether you run Riot-Os Riot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The nanocoap_fileserver in sys/net/application_layer/nanocoap/fileserver.c ignores the failure return value from _resp_init() when coap_build_reply() cannot allocate space in the response buffer. When nanocoap_token_ext is enabled, a remote client can send a CoAP request with an oversized extended token, causing _resp_init() to fail while _get_file() or _get_directory() continues with stale response state. The code then hits an assertion in _calc_szx2() when pdu->payload_len exceeds reserve, terminating the task.

## Affected products

- RIOT-OS RIOT 2023.07 through 2026.07

## Timeline

- 2026-10-09: disclosed

## References

- [https://github.com/RIOT-OS/RIOT/commit/d3a47289c58d108575a19e623e4d3f647659e743](https://github.com/RIOT-OS/RIOT/commit/d3a47289c58d108575a19e623e4d3f647659e743)
- [https://github.com/RIOT-OS/RIOT/pull/22745](https://github.com/RIOT-OS/RIOT/pull/22745)

## Related threats

- [RIOT DHCPv6 client out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-49868-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap integer overflow in Block2 option parsing](https://junglewise.ai/threats/cve-2026-102692-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT operating system out-of-bounds read in 6LoWPAN fragment handling](https://junglewise.ai/threats/cve-2026-107837-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanoCoAP client buffer underflow in blockwise transfer](https://junglewise.ai/threats/cve-2026-107836-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT OS stack overflow in ethos serial frame parser](https://junglewise.ai/threats/cve-2026-22214-riot-os-stack-overflow-in-ethos-serial-frame-parser)