CVE-2026-107838

{
  "etk_id": "ETK-2026-1106",
  "cve_id": "CVE-2026-107838",
  "display_id": "CVE-2026-107838",
  "ghsa_id": "GHSA-39j3-3v73-5mj2",
  "euvd_id": "EUVD-2026-95933",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Remote denial of service in RIOT nanocoap_fileserver",
  "summary": "RIOT versions 2023.07 through 2026.07 can terminate a nanocoap_fileserver service or device task after processing a malformed CoAP request. Exposure requires nanocoap_token_ext to be enabled and an attacker able to reach the affected CoAP service.",
  "mitigation": "Disable nanocoap_token_ext where it is not required, and restrict access to CoAP services to trusted networks or clients. Monitor RIOT for an updated release, as no fixed version is currently recorded.",
  "vendor": "RIOT-OS",
  "product": "RIOT",
  "affected": [
    {
      "affected_notes": [
        "Since 2023.07"
      ],
      "affected_ranges": [],
      "ecosystem": "riot os",
      "fixed_versions": [],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    252
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0034,
  "epss_percentile": 0.2588,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 44.57565843333333,
  "t0_at": "2026-10-09T17:55:34.670000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T17:55:34.670000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T17:55:34.670000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107838"
    }
  }
}