EUVD-2026-42086
GHSA-f5vp-w269-392g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable HTTP endpoint (AV:N), trivial to exploit (AC:L), member-level auth required (PR:L), availability-only impact crashing coderd in-process (A:H, S:U).
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
1DescriptionCVE.org
Summary
AI Bridge provider handlers read request bodies with io.ReadAll without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory.
> Note: Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service).
Impact
An authenticated member-level user could POST a very large or chunked body to an AI Bridge provider endpoint such as /api/v2/aibridge/anthropic/v1/messages, growing heap memory until the operating system terminates the process. Because AI Bridge runs in-process with coderd, this crashes the entire control plane, including the API, workspace coordinator and DERP relay. It requires an authenticated user and the AI Bridge feature enabled.
Patches
The fix applies http.MaxBytesReader or an equivalent cap before reading provider and session request bodies. The affected AI Bridge provider endpoints exist only on the v2.33 and v2.34 lines. Earlier release lines are not affected.
The fix is available in the following releases:
Workarounds
None.
Resources
- Fix: #26164
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22443) for independently disclosing this issue!
AnalysisAI
Memory exhaustion in Coder's AI Bridge feature allows an authenticated member-level user to crash the entire control plane by sending arbitrarily large HTTP request bodies to provider endpoints such as /api/v2/aibridge/anthropic/v1/messages. Because AI Bridge runs in-process with coderd, a single crafted request can grow heap memory until the OS terminates the process, taking down the API server, workspace coordinator, and DERP relay simultaneously. No public exploit has been identified at time of analysis, but the vendor credits Anthropic's Security Team (ANT-2026-22443) with independent discovery, indicating external security research attention. Patched versions are available for the affected v2.33 and v2.34 release lines.
Technical ContextAI
The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): Go's io.ReadAll is used to consume HTTP request bodies in AI Bridge provider handler functions without imposing a maximum read size. The affected package is pkg:go/github.com_coder_coder_v2, specifically the v2.33 and v2.34 release lines which introduced the AI Bridge feature. The fix replaces unbounded reads with http.MaxBytesReader or an equivalent cap before processing provider and session request bodies. Because coderd - Coder's central control plane daemon - hosts the AI Bridge handlers in-process, memory exhaustion in a single handler function kills the entire process, including the workspace lifecycle API, the workspace proxying coordinator, and the DERP relay used for peer-to-peer workspace connectivity.
RemediationAI
Upgrade to v2.34.2 (https://github.com/coder/coder/releases/tag/v2.34.2) or v2.33.8 (https://github.com/coder/coder/releases/tag/v2.33.8) as appropriate for your release line. The fix introduces http.MaxBytesReader to cap inbound request body size before any heap allocation occurs. The vendor confirms no workarounds exist within the application itself. As a compensating control where immediate patching is not possible, operators may consider blocking or rate-limiting requests to the /api/v2/aibridge/ path prefix at a reverse proxy or WAF layer - this prevents exploitation but also disables AI Bridge functionality entirely for all users. Restricting AI Bridge access to a narrower set of trusted users at the identity provider or Coder RBAC level reduces the attacker pool but does not eliminate the vulnerability. Release v2.33 users still receiving support should prioritize patching given no workaround exists.
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today