Junglewise Threat Intelligence

CVE-2026-55078: Coder denial of service via unbounded memory allocation in ZIP conversion

CVE-2026-55078 · Severity: medium · CVSS 6.5 · Published 2026-07-07

Technologies: github.com/coder/coder/v2 (Go), Coder, github.com/coder/coder (Go). Vendors: Go, Coder.

Executive brief

Coder, a platform used by organizations to manage remote development environments, is vulnerable to a denial-of-service attack. An authenticated user could upload a specially crafted compressed file that expands excessively in the server's memory, potentially crashing the service. This would disrupt the availability of development environments for all users until the system is recovered.

Technical details

A data amplification vulnerability (CWE-409) exists in Coder's `POST /api/v2/files` endpoint. The `CreateTarFromZip` function converts uploaded ZIP files to TAR format in memory using an unbounded buffer. While the function enforced per-entry size limits, it failed to enforce an aggregate limit on the total decompressed output. An authenticated attacker with file-upload permissions can exploit this to cause an Out-of-Memory (OOM) denial-of-service. The vulnerability is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by implementing a metadata preflight check and a streaming writer that enforces aggregate size limits.

Affected products

  • Coder Coder >= 2.17.0, < 2.29.17; >= 2.30.0, < 2.32.7; >= 2.33.0, < 2.33.8; >= 2.34.0, < 2.34.2

Timeline

  • 2026-05-30: other: Fix developed in pull request #25877
  • 2026-06-02: patched: Fix merged into main branch
  • 2026-06-11: advisory: Security releases published for multiple versions
  • 2026-07-07: disclosed: CVE-2026-55078 published

References

Related threats