Coder CVE-2026-55078
MEDIUM
GHSA-2mg2-p7r7-g27f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable API endpoint, low-complexity trigger, low-privilege authentication required; availability-only impact with no confidentiality or integrity effect.
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
1DescriptionCVE.org
Summary
POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer.
> Note: Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service).
Impact
An authenticated user could upload a zip within the 100 MiB upload limit but containing many highly compressible entries whose decompressed size exhausted memory, crashing coderd before any RBAC check. Repeated requests could keep the service unavailable. This is a denial of service; it does not allow data disclosure or code execution.
Patches
The fix adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression.
The fix was backported to all supported release lines:
Workarounds
Restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of coderd.
Resources
- Fix: #25877
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22438) for independently disclosing this issue!
AnalysisAI
Denial of service in Coder's coderd server allows any authenticated user with file-upload access to exhaust server memory by uploading a crafted zip bomb via POST /api/v2/files, crashing the service before RBAC checks execute. Affected versions span all supported release lines prior to v2.34.2, v2.33.8, v2.32.7, and v2.29.17 (ESR). No public exploit has been identified at time of analysis; the impact is strictly an availability loss - the advisory explicitly confirms no data disclosure or code execution is possible, contradicting the 'RCE' tag present in the intelligence feed.
Technical ContextAI
The vulnerable code path is the CreateTarFromZip function, invoked by coderd's file-upload API endpoint (POST /api/v2/files) to convert zip archives into tar format entirely in memory. CWE-409 (Improper Handling of Highly Compressed Data) is the root cause: the implementation enforced a per-entry decompressed size limit but applied no aggregate cap on total decompressed output across all entries, writing results into an unbounded in-memory buffer. A zip bomb - an archive whose many small, highly compressible entries expand to a total size far exceeding the compressed input - can therefore cause memory exhaustion even when the upload itself stays within the enforced 100 MiB HTTP request-body limit. The affected Go package is pkg:go/github.com_coder_coder_v2 across all supported release lines. The fix introduces a metadata preflight pass that sums projected decompressed entry sizes and replaces the unbounded buffer with a streaming writer that enforces an aggregate decompression limit.
RemediationAI
Upgrade to the vendor-released patched versions: v2.34.2 for the 2.34 release line, v2.33.8 for 2.33, v2.32.7 for 2.32, or v2.29.17 for the 2.29 ESR line. Release artifacts and changelogs are available at the respective GitHub release tags linked in the advisory at https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f. If immediate patching is not possible, two workarounds are available: first, restrict file-upload permissions to only explicitly trusted users, which eliminates the attack surface for untrusted accounts but may disrupt workflows that rely on upload access; second, place a reverse proxy (e.g., nginx, Caddy) in front of coderd configured with a strict request-body size limit - this reduces the maximum amplification ratio an attacker can achieve but does not fully eliminate the risk since the exploit works within a 100 MiB limit. The fix PR is available at https://github.com/coder/coder/pull/25877.
Vendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today