GHSA-39j3-3v73-5mj2: RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

Q: Which deployments are exposed to this issue?

Deployments using RIOT versions 2023.07 through 2026.07 are affected if they use nanocoap_fileserver and have nanocoap_token_ext enabled. The issue is reachable by a remote CoAP client.

Q: What does an attacker need to do to trigger the failure?

An unauthenticated remote client must send a CoAP request containing a sufficiently large extended token. The oversized token causes the response header not to fit in the response buffer, after which stale response state reaches an assertion.

Q: What is the practical impact of successful exploitation?

Triggering the assertion terminates the affected service or device task, resulting in a denial of service. The provided information does not indicate confidentiality or integrity impact.

Q: Is a fixed RIOT release available?

No fixed release was available as of the review. The affected version range provided is 2023.07 through 2026.07.

Published Oct 9, 2026

Updated

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoapfileserver callers in sys/net/applicationlayer/nanocoap/fileserver.c ignore a failure returned by respinit() when coapbuildreply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoaptokenext is enabled, causing response initialization to fail while getfile() or getdirectory() continues with stale response state. The path then reaches calcszx2() and its pdu->payloadlen > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.

Affected Software

1 affected component

RIOT RIOT>=2023.07<=2026.07

Event History

Oct 9, 2026

CVE Published

via OSV·05:55 PM

Data Sourced

via OSV·05:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using RIOT versions 2023.07 through 2026.07 are affected if they use nanocoap_fileserver and have nanocoap_token_ext enabled. The issue is reachable by a remote CoAP client.

What does an attacker need to do to trigger the failure?

An unauthenticated remote client must send a CoAP request containing a sufficiently large extended token. The oversized token causes the response header not to fit in the response buffer, after which stale response state reaches an assertion.

What is the practical impact of successful exploitation?

Triggering the assertion terminates the affected service or device task, resulting in a denial of service. The provided information does not indicate confidentiality or integrity impact.

Is a fixed RIOT release available?

No fixed release was available as of the review. The affected version range provided is 2023.07 through 2026.07.

GHSA-39j3-3v73-5mj2: RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What is the practical impact of successful exploitation?

Is a fixed RIOT release available?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the failure?

What is the practical impact of successful exploitation?

Is a fixed RIOT release available?