CVE-2026-55078 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
Authenticated attackers can cause denial of service in Coder by uploading zip files that exhaust memory during decompression due to missing aggregate size limits.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55078?
CVE-2026-55078 is a medium-severity denial of service vulnerability in coder, published on 7 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.
Which versions are affected by CVE-2026-55078?
10 open source packages ship an affected version, including github.com/coder/coder/v2 and github.com/coder/coder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coder/coder/v2 Go | From 2.17.0 | 2.29.17, 2.32.7, 2.33.8, 2.34.2 |
github.com/coder/coder/v2 Go | From 2.17.0 | 2.29.17 |
github.com/coder/coder/v2 Go | From 2.17.0 | 2.29.17 |
github.com/coder/coder/v2 Go | From 2.30.0 | 2.32.7 |
github.com/coder/coder/v2 Go | From 2.30.0 | 2.32.7 |
github.com/coder/coder/v2 Go | From 2.33.0 | 2.33.8 |
4 more packages
github.com/coder/coder/v2 Go | From 2.33.0 | 2.33.8 |
github.com/coder/coder/v2 Go | From 2.34.0 | 2.34.2 |
github.com/coder/coder/v2 Go | From 2.34.0 | 2.34.2 |
github.com/coder/coder Go | All versions | None |
Products include Coder Coder.
How do I fix CVE-2026-55078?
Upgrade github.com/coder/coder/v2 to a fixed version for your release line: 2.29.17, 2.32.7, 2.33.8 or 2.34.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-55078 being exploited?
There is no known exploitation of CVE-2026-55078 in the wild and no public exploit code.
Other vulnerabilities in coder
- CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
- CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
- CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
- CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
- CVE-2024-27918 Coder's OIDC authentication allows email with partially matching domain to register
Sources
Also known as GHSA-2mg2-p7r7-g27f, GO-2026-5916.