CVE-2026-55079: Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
Summary
NewDataBuilder in provisionersdk/proto/dataupload.go allocated a byte slice using the client-supplied FileSize from a DataUpload message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the FileSize value itself was unconstrained
Impact
An authenticated user able to reach the provisioner daemon serve endpoint could send a roughly 50-byte message declaring a huge FileSize (for example 1 TiB), triggering an unrecoverable Go out-of-memory abort that terminates coderd. This is a single-message denial of service affecting the entire deployment.
Patches
The fix validates FileSize against an upper bound (MaxFileSize = 100 MiB) before allocation.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
Restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
Resources
- Fix: #25710
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22442) for independently disclosing this issue!
Other sources
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, NewDataBuilder in provisionersdk/proto/dataupload.go allocated a byte slice using the client-supplied FileSize from a DataUpload message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the FileSize value itself was unconstrained. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates FileSize against an upper bound (MaxFileSize = 100 MiB) before allocation. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.29.7 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.34.2 - Compensating control
As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55079?
The severity of CVE-2026-55079 is medium with a score of 6.5.
What is the risk associated with CVE-2026-55079?
CVE-2026-55079 has a risk level of 38, indicating a potential for denial of service due to unbounded memory allocation.
How do I fix CVE-2026-55079?
To fix CVE-2026-55079, implement a check for an upper-bound limit on the client-supplied FileSize in the DataUpload message.
What impacts does CVE-2026-55079 have?
CVE-2026-55079 can lead to authenticated denial of service by allowing excessive memory allocation during file uploads.
Which software is affected by CVE-2026-55079?
CVE-2026-55079 affects the Coder Go software version v2.