{"schema":"threatline.record/2","record":{"id":"CVE-2026-107838","aliases":["GHSA-39j3-3v73-5mj2"],"summary":"RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion","details":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu->payload_len > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.","categories":["Unclassified"],"product":"RIOT","vendor":"RIOT-OS","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107838","source_modified_at":"2026-10-13T17:07:38.700Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"RIOT","vendor":"RIOT-OS","versions":[{"version":">= 2023.07, <= 2026.07","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00339,"percentile":0.26114,"score_date":"2026-10-23"},"published_at":"2026-10-09T17:55:34.670Z","modified_at":"2026-10-13T17:07:38.700Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107838","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T17:07:38.700Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107838","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-39j3-3v73-5mj2","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/RIOT-OS/RIOT/pull/22745","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/RIOT-OS/RIOT/commit/d3a47289c58d108575a19e623e4d3f647659e743","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-13T17:07:15.908632Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T17:07:38.700Z","content_hash":"ab82053dceb7420b41f0405aa0bed0e7afaaf6d9a5c952a4388122a39302b8f0"}}