CVE-2026-107838: CWE-252: Unchecked Return Value in RIOT-OS RIOT

RIOT-OS versions 2023.07 through 2026.07 contain a vulnerability in the nanocoap_fileserver module (sys/net/application_layer/nanocoap/fileserver.c) where callers ignore the failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote attacker can exploit this by sending a CoAP request with a sufficiently large extended token, causing response initialization to fail but allowing _get_file() or _get_directory() to continue operating with stale response state. This leads to an assertion failure in _calc_szx2() when pdu->payload_len exceeds the reserved size, resulting in termination of the affected service or device task. No patch or fixed release is currently available as of the latest review.

The vulnerability can cause denial of service by terminating the affected service or device task due to assertion failure. It does not impact confidentiality or integrity but results in availability disruption. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisories for updates and consider implementing network-level protections to limit exposure to malicious CoAP requests with large extended tokens. Avoid enabling nanocoap_token_ext if possible until a fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.