CVE-2026-55434 Details
Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service). Versions 2.33.8 and 2.34.2 patch the issue. No known workarounds are available.
A denial-of-service vulnerability has been identified in the Coder application, specifically within the AI Bridge provider handlers. This issue is present in Coder versions 2.33.0 prior to 2.33.8 and in versions 2.34.0 prior to 2.34.2. The vulnerability arises because the AI Bridge provider handlers read request bodies using 'io.ReadAll' without a maximum size limit. As a result, an authenticated user with AI Bridge access could send an arbitrarily large request body, exhausting the application's memory. Exploitation of this vulnerability requires authenticated access to the AI Bridge endpoints, and the impact is limited to availability, causing a denial-of-service condition.
Users can upgrade to Coder version 2.33.8 or 2.34.2, both of which include the necessary patch. Instructions for upgrading Coder are available in the Coder documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coder/coder/pull/26164 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/releases/tag/v2.33.8 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.34.2 | [email protected] | Release Notes |
| https://github.com/coder/coder/security/advisories/GHSA-f5vp-w269-392g | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coder coder | >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.34.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |