CVE-2026-55079 Details
Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
A denial-of-service vulnerability has been identified in Coder's remote development environment provisioning feature, specifically within the NewDataBuilder function of the provisionersdk/proto/dataupload.go file. This issue affects Coder versions 2.24.0 prior to 2.29.7, as well as versions 2.30.0 prior to 2.32.7, and versions 2.33.0 prior to 2.33.8. The vulnerability arises because NewDataBuilder allocates a byte slice based on the client-supplied FileSize from a DataUpload message, without any upper-bound validation. Although the DRPC wire limit is 4 MiB, the FileSize value was unconstrained, allowing for the possibility of excessive memory allocation. Exploitation of this vulnerability causes an out-of-memory error that crashes the Coder daemon, coderd, leading to a significant disruption of service.
Users can upgrade to Coder versions 2.29.17, 2.32.7, 2.33.8, or 2.34.2, all of which include the necessary patch. Additionally, access to the provisioner daemon serve endpoint can be restricted to trusted service accounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coder/coder/pull/25710 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/releases/tag/v2.29.17 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.32.7 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.33.8 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.34.2 | [email protected] | Release Notes |
| https://github.com/coder/coder/security/advisories/GHSA-f962-qm93-mj4c | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coder coder | >= 2.24.0, < 2.29.17 >= 2.30.0, < 2.32.7 >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.34.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |