CVE-2026-55079— Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55079
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
Source: NVD (National Vulnerability Database)
Vulnerability Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
未经控制的内存分配
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-55079
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55079
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55079 (1)
Vendor Advisories for CVE-2026-55079 (1)
Vendor Pages for CVE-2026-55079 (4)
Same Patch Batch · coder · 2026-07-07 · 12 CVEs total
| CVE-2026-46354 | 9.1 CRITICAL | Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent tok |
| CVE-2026-55427 | 8.3 HIGH | Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder |
| CVE-2026-55428 | 8.2 HIGH | Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet |
| CVE-2026-44454 | 8.1 HIGH | Coder vulnerable to workspace auto-creation via crafted URL parameters without user consen |
| CVE-2026-55075 | 7.4 HIGH | Coder vulnerable to OIDC account takeover via email-based user matching and email_verified |
| CVE-2026-55076 | 7.4 HIGH | Coder's OIDC email_verified type coercion bypass enables account takeover via unverified e |
| CVE-2026-55077 | 7.2 HIGH | Coder: User-admin role can reset owner account password |
| CVE-2026-55434 | 6.5 MEDIUM | Coder vulnerable to denial of service via unbounded request body in AI Bridge provider end |
| CVE-2026-45796 | 6.5 MEDIUM | Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint |
| CVE-2026-55078 | 6.5 MEDIUM | Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service |
| CVE-2026-55435 | 5.4 MEDIUM | Suspended Coder users retain access to AI Bridge LLM proxy endpoints |
IV. Related Vulnerabilities
Same product: coder
- CVE-2026-55438
Coder's workspace app CORS origin check can be bypassed via - CVE-2026-55437
Coder vulnerable to stored HTML injection via workspace agen - CVE-2026-55436
Coder's AI Bridge Proxy skips TLS certificate verification i - CVE-2026-55433
Coder: Devcontainer recreate endpoint missing write authoriz - CVE-2026-55432
Coder's sub-agent app registration bypasses template port-sh
Same vendor: coder
- CVE-2026-55438
Coder's workspace app CORS origin check can be bypassed via - CVE-2026-55437
Coder vulnerable to stored HTML injection via workspace agen - CVE-2026-55436
Coder's AI Bridge Proxy skips TLS certificate verification i - CVE-2026-55433
Coder: Devcontainer recreate endpoint missing write authoriz - CVE-2026-55432
Coder's sub-agent app registration bypasses template port-sh
Same weakness: CWE-789
- CVE-2026-59938
pypdf: Possible large memory usage for wrong image dimension - CVE-2026-15053
Tanium addressed a denial of service vulnerability in Tanium - CVE-2026-55379
Pillow BdfFontFile`: `Image.new()` called without `_decompre - CVE-2026-55380
Pillow GdImageFile decompression bomb protection bypass - CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `
V. Comments for CVE-2026-55079
No comments yet