CVE-2026-55079
mediumpriority · track · 26EPSS 0.006 · 49 %ileEUUSEPSS · scored 2026-10-27
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (13)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-f962-qm93-mj4cCoder's unbounded memory allocation in provisioner file upload allows authenticated denial of service2026-07-06ghsa · osvUS
### Summary `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained ### Impact An authenticated user able to reach the provisioner daemon serve endpoint could send a roughly 50-byte message declaring a huge `FileSize` (for example 1 TiB), triggering an unrecoverable Go out-of-memory abort that terminates `coderd`. This is a single-message denial of service affecting the entire deployment. ### Patches The fix validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts. ### Resources - Fix: #25710 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22442) for independently disclosing this issue!
- GO-2026-5911Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder2026-07-07vendor · osvUS
Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service in github.com/coder/coder
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (19)
External citations — patches, advisories, analysis.
- https://github.com/coder/coder/pull/25710cnnvd
- https://github.com/coder/coder/releasesPatchcnnvd
- https://github.com/coder/coder/releases/tag/v2.29.17cnnvd
- https://github.com/coder/coder/releases/tag/v2.32.7cnnvd
- https://github.com/coder/coder/releases/tag/v2.33.8cnnvd
- https://github.com/coder/coder/releases/tag/v2.34.2cnnvd
- https://github.com/coder/coder/security/advisories/GHSA-f962-qm93-mj4ccnnvd
- https://github.com/coder/coder/pull/25710enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan