Coder CVE-2026-55079

The affected component is the provisionersdk Go package within the Coder remote development platform (CPE: pkg:go/github.com_coder_coder_v2), specifically the NewDataBuilder function in provisionersdk/proto/dataupload.go. Coder uses DRPC (a lightweight RPC framework) for communication with its provisioner daemon, which manages infrastructure provisioning for developer workspaces. The DataUpload DRPC message type includes a FileSize field that is intended to pre-declare the size of a file transfer so the receiver can pre-allocate a buffer. The root cause, classified as CWE-789 (Uncontrolled Memory Allocation), is that NewDataBuilder uses this client-supplied FileSize directly in a Go byte slice allocation (make([]byte, FileSize)) without validating it against any maximum. Although the DRPC wire protocol enforces a 4 MiB message body limit, this limit applies to the actual bytes on the wire - it does not constrain the integer value declared in the FileSize field of the message payload. The fix introduces a MaxFileSize constant of 100 MiB and validates the declared size before allocation, rejecting values that exceed the bound.