PT-2026-56069 · Coder · Coder

Published 2026-07-06 · Updated 2026-07-08 · CVE-2026-55079

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions coder versions prior to 2.34.2 coder versions prior to 2.33.8 coder versions prior to 2.32.7 coder versions prior to 2.29.17

Description An authenticated user can trigger a denial of service by sending a small message with an excessively large FileSize value to the provisioner daemon serve endpoint. The NewDataBuilder function in provisionersdk/proto/dataupload.go allocates a byte slice based on the FileSize variable from a DataUpload message without performing an upper-bound check. This can lead to an unrecoverable Go out-of-memory abort that terminates the coderd process, affecting the entire deployment.

Recommendations Update to version 2.34.2 or later. Update to version 2.33.8 or later. Update to version 2.32.7 or later. Update to version 2.29.17 or later. Restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-55079

GHSA-F962-QM93-MJ4C

GO-2026-5911

Affected Products

Coder

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-55079 · Security Note
• https://osv.dev/vulnerability/GO-2026-5911 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f962-qm93-mj4c · Vendor Advisory
• https://github.com/coder/coder/releases/tag/v2.29.17 · Note
• https://github.com/coder/coder/releases/tag/v2.33.8 · Note
• https://github.com/coder/coder/releases/tag/v2.34.2 · Note
• https://github.com/coder/coder/releases/tag/v2.32.7 · Note
• https://github.com/coder/coder/security/advisories/GHSA-f962-qm93-mj4c · Note
• https://github.com/coder/coder/pull/25710 · Note
• https://github.com/coder/coder · Note