6.5 CVE-2026-55078
Enriched by CISA Patch
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.
https://nvd.nist.gov/vuln/detail/CVE-2026-55078
Categories
CWE-409 : Improper Handling of Highly Compressed Data (Data Amplification)
An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
References
security-advisories@github.com Patch
| https://github.com/coder/coder/pull/25877 Issue Tracking Patch |
| https://github.com/coder/coder/releases/tag/v2.29.17 Release Notes |
| https://github.com/coder/coder/releases/tag/v2.32.7 Release Notes |
| https://github.com/coder/coder/releases/tag/v2.33.8 Release Notes |
| https://github.com/coder/coder/releases/tag/v2.34.2 Release Notes |
| https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f Patch Vendor Advisory |
AFFECTED (from MITRE)
| Vendor | Product | Versions |
|---|---|---|
| coder | coder |
|
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. | ||
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:* | >= 2.17.0 | < 2.29.17 |
| cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:* | >= 2.30.0 | < 2.32.7 |
| cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:* | >= 2.33.0 | < 2.33.8 |
| cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:* | >= 2.34.0 | < 2.34.2 |
REMEDIATION
Patch
| Url |
|---|
| https://github.com/coder/coder/pull/25877 |
| https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f |
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| No entry | ||
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
