CVE-2026-55078: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
Summary
POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer.
Note: Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service).
Impact
An authenticated user could upload a zip within the 100 MiB upload limit but containing many highly compressible entries whose decompressed size exhausted memory, crashing coderd before any RBAC check. Repeated requests could keep the service unavailable. This is a denial of service; it does not allow data disclosure or code execution.
Patches
The fix adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
Restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of coderd.
Resources
- Fix: #25877
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22438) for independently disclosing this issue!
Other sources
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of coderd.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
coderd (Coder)to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
coderd (Coder)to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
coderd (Coder)to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
coderd (Coder)to a version that resolves this vulnerability.Fixed in 2.34.2 - Compensating control
Restrict file-upload permissions to trusted users (to mitigate authenticated zip upload DoS against POST /api/v2/files on coderd).
- Compensating control
Place a reverse proxy in front of coderd and configure it to enforce request-body size limits for uploads (to mitigate DoS via POST /api/v2/files zip uploads).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55078?
CVE-2026-55078 has a medium severity rating of 6.5.
What risk does CVE-2026-55078 pose?
CVE-2026-55078 poses a denial of service risk due to unbounded in-memory decompression of uploaded zip files.
How do I fix CVE-2026-55078?
To fix CVE-2026-55078, implement an aggregate size limit on the total decompressed output for zip uploads.
Who is affected by CVE-2026-55078?
CVE-2026-55078 affects users of the Coder Go software who have file-upload access.
What type of access is required to exploit CVE-2026-55078?
Exploitation of CVE-2026-55078 requires authenticated file-upload access.