CVE-2026-107838

Summary

A flaw in RIOT OS's nanocoap_fileserver allows remote attackers to cause a service crash or device task termination by sending a specially crafted CoAP request with an extended token. This occurs when response initialization fails but the system continues processing with stale state, leading to assertion failures and system instability.

Exploitability

Exploitation is moderately difficult as it requires sending a specific CoAP request with a large extended token to a device running nanocoap_token_ext, but the attack can be automated and doesn't require special privileges.

Blast radius

The impact could affect many IoT devices running RIOT OS versions 2023.07 through 2026.07, potentially causing widespread service disruption or device unavailability across connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable nanocoap_token_ext functionality until a fixed version is available, as no specific release with a fix is mentioned in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.