Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-55078Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

Medium 6.5

In plain English

A medium-severity resource allocation without limits in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 51.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/coder/coder	no fix listed	GO-2026-5916
Go	github.com/coder/coder/v2	2.34.2	GHSA-2mg2-p7r7-g27f
Go	github.com/coder/coder/v2	2.33.8	GHSA-2mg2-p7r7-g27f
Go	github.com/coder/coder/v2	2.32.7	GHSA-2mg2-p7r7-g27f
Go	github.com/coder/coder/v2	2.29.17	GHSA-2mg2-p7r7-g27f
Go	github.com/coder/coder/v2	2.29.17, 2.32.7, 2.33.8, 2.34.2	GO-2026-5916

Affected products (as reported)

Vendor	Product	Versions
coder	coder	>= 2.34.0, < 2.34.2>= 2.33.0, < 2.33.8>= 2.30.0, < 2.32.7>= 2.17.0, < 2.29.17

Weakness: CWE-409, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f x_refsource_CONFIRM
https://github.com/coder/coder/pull/25877 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.29.17 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.32.7 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.33.8 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.34.2 x_refsource_MISC