CVE-2026-55078 Details
Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.
A denial-of-service vulnerability has been identified in Coder versions 2.17.0 prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The issue arises in the 'POST /api/v2/files' endpoint, where zip file uploads are converted to tar format in memory. While a per-entry size limit is enforced, there is no aggregate limit on the total decompressed size, allowing for excessive memory usage. Exploitation of this vulnerability requires authenticated file-upload access, and the impact is a significant denial-of-service, causing the 'coderd' service to crash without any role-based access control checks.
Users can upgrade to Coder versions 2.29.17, 2.32.7, 2.33.8, or 2.34.2, all of which include the necessary fix. Instructions for upgrading Coder are available in the Coder documentation. As an additional step, file-upload permissions can be restricted to trusted users or a reverse proxy with request-body size limits can be placed in front of the 'coderd' service.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coder/coder/pull/25877 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/releases/tag/v2.29.17 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.32.7 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.33.8 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.34.2 | [email protected] | Release Notes |
| https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coder coder | >= 2.17.0, < 2.29.17 >= 2.30.0, < 2.32.7 >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.34.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |