GHSA-x924-p5fq-26pc: RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

Q: Which deployments are exposed to this issue?

RIOT devices using the nanoCoAP client path affected by nanocoap_sock_get_slice() are exposed when they retrieve Block2 responses from a malicious or compromised CoAP server. RIOT 2026.07 and earlier are affected.

Q: What does an attacker need to exploit it?

An attacker needs to control, impersonate, or otherwise cause the client to communicate with a CoAP server that can send a crafted Block2 response. The crafted response must use the block number the client expects while reporting a larger block size that creates an inconsistent derived offset.

Q: Is user interaction or prior authentication required?

The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and user interaction required. The advisory description does not specify what user action initiates the affected CoAP request.

Q: What can be done while no fixed release is available?

Avoid fetching Block2 content from untrusted CoAP servers and restrict network access so devices can communicate only with trusted, authenticated CoAP endpoints where possible. Monitor or isolate devices that make nanoCoAP slice requests to servers outside the intended trust boundary.

Q: What are the likely effects of successful exploitation?

A crafted response can cause a buffer-relative calculation to read before the payload buffer, potentially crashing the client and causing denial of service. Adjacent memory may also be exposed.

Published Oct 9, 2026

Updated

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoapsockgetslice() in sys/net/applicationlayer/nanocoap/sock.c accepts a Block2 response when blockcb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in 2bufslice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.

Affected Software

1 affected component

RIOT RIOT<=2026.07

Event History

Oct 9, 2026

CVE Published

via OSV·05:49 PM

Data Sourced

via OSV·05:49 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

RIOT devices using the nanoCoAP client path affected by nanocoap_sock_get_slice() are exposed when they retrieve Block2 responses from a malicious or compromised CoAP server. RIOT 2026.07 and earlier are affected.

What does an attacker need to exploit it?

An attacker needs to control, impersonate, or otherwise cause the client to communicate with a CoAP server that can send a crafted Block2 response. The crafted response must use the block number the client expects while reporting a larger block size that creates an inconsistent derived offset.

Is user interaction or prior authentication required?

The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and user interaction required. The advisory description does not specify what user action initiates the affected CoAP request.

What can be done while no fixed release is available?

Avoid fetching Block2 content from untrusted CoAP servers and restrict network access so devices can communicate only with trusted, authenticated CoAP endpoints where possible. Monitor or isolate devices that make nanoCoAP slice requests to servers outside the intended trust boundary.

What are the likely effects of successful exploitation?

A crafted response can cause a buffer-relative calculation to read before the payload buffer, potentially crashing the client and causing denial of service. Adjacent memory may also be exposed.

GHSA-x924-p5fq-26pc: RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Is user interaction or prior authentication required?

What can be done while no fixed release is available?

What are the likely effects of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Is user interaction or prior authentication required?

What can be done while no fixed release is available?

What are the likely effects of successful exploitation?