CVE-2026-126405: Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push
Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who can register a Web Push subscription through POST /api/v2/users/{user}/webpush/subscription can point the subscription endpoint at a server that returns an endless response body.
What impact should operators expect from successful exploitation?
The unbounded response read can exhaust coderd memory and crash the API, dashboard, and workspace connections.
Which releases are affected and which releases contain fixes?
Affected release lines are 2.21.0 through before 2.29.24, 2.30.0 through before 2.34.16, 2.35.0 through before 2.36.11, 2.37.0 through before 2.37.8, and 2.38.0 through before 2.38.4. The stated fixed versions are 2.29.24, 2.34.16, 2.36.11, 2.37.8, and 2.38.4.