# CVE-2026-55078: Coder denial of service via unbounded memory allocation in ZIP conversion

Source: https://junglewise.ai/threats/cve-2026-55078-coder-denial-of-service-via-unbounded-memory-allocation-in-zip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-55078 · Severity: medium · CVSS 6.5 · Published 2026-07-07

Coder, a platform used by organizations to manage remote development environments, is vulnerable to a denial-of-service attack. An authenticated user could upload a specially crafted compressed file that expands excessively in the server's memory, potentially crashing the service. This would disrupt the availability of development environments for all users until the system is recovered.

Technologies: [Coder](https://junglewise.ai/threats/technologies/coder), [github.com/coder/coder (Go)](https://junglewise.ai/threats/technologies/github-com-coder-coder), [github.com/coder/coder/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-coder-coder-v2). Vendors: [Coder](https://junglewise.ai/threats/vendors/coder), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55078 being exploited in the wild.

**How severe is CVE-2026-55078?** Medium severity, with a CVSS score of 6.5, published 7 July 2026.

**Which products and versions are affected?** Coder >= 2.17.0, < 2.29.17; >= 2.30.0, < 2.32.7; >= 2.33.0, < 2.33.8; >= 2.34.0, < 2.34.2, >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; >= 2.17.0, < 2.29.17; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=2.17.0,fixed=2.29.17,introduced=2.30.0,fixed=2.32.7,introduced=2.33.0,fixed=2.33.8,introduced=2.34.0,fixed=2.34.2, SEMVER:introduced=2.34.0,fixed=2.34.2.

**Is there a fix for CVE-2026-55078?** Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55078 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55078?** Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later

  ```sh
  go get github.com/coder/coder/v2@v2.34.2
  ```


## Technical details

A data amplification vulnerability (CWE-409) exists in Coder's `POST /api/v2/files` endpoint. The `CreateTarFromZip` function converts uploaded ZIP files to TAR format in memory using an unbounded buffer. While the function enforced per-entry size limits, it failed to enforce an aggregate limit on the total decompressed output. An authenticated attacker with file-upload permissions can exploit this to cause an Out-of-Memory (OOM) denial-of-service. The vulnerability is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by implementing a metadata preflight check and a streaming writer that enforces aggregate size limits.

## Affected products

- Coder Coder >= 2.17.0, < 2.29.17; >= 2.30.0, < 2.32.7; >= 2.33.0, < 2.33.8; >= 2.34.0, < 2.34.2

## Identifiers

- CVE-2026-55078
- GHSA-2mg2-p7r7-g27f
- GO-2026-5916

## Timeline

- 2026-05-30: other: Fix developed in pull request #25877
- 2026-06-02: patched: Fix merged into main branch
- 2026-06-11: advisory: Security releases published for multiple versions
- 2026-07-07: disclosed: CVE-2026-55078 published

## References

- [https://github.com/coder/coder/pull/25877](https://github.com/coder/coder/pull/25877)
- [https://github.com/coder/coder/releases/tag/v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17)
- [https://github.com/coder/coder/releases/tag/v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7)
- [https://github.com/coder/coder/releases/tag/v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8)
- [https://github.com/coder/coder/releases/tag/v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2)
- [https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f](https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f)

## Related threats

- [Coder AI Gateway encoded path traversal](https://junglewise.ai/threats/cve-2026-121967-coder-2-28-0-before-2-29-22-2-30-0-before-2-34-13-2-35-0-before)
- [Coder missing audience validation in GCP instance-identity endpoint](https://junglewise.ai/threats/cve-2026-118687-coder-before-2-29-21-2-30-0-before-2-34-12-2-35-0-before-2-35-9)
- [Coder open redirect in workspace app proxy](https://junglewise.ai/threats/cve-2026-111931-coder-from-2-0-0-before-2-34-8-contains-an-open-redirect)
- [Coder workspace ACL endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-111930-coder-from-2-26-0-before-2-34-8-contains-an-incorrect)
- [Coder provisioner daemon authorization bypass in DownloadFile](https://junglewise.ai/threats/cve-2026-111929-coder-from-2-30-0-before-2-34-8-contains-an-authorization-bypass)