CVE-2026-55078: Coder Coder DOS Vulnerability

CVE-2026-55078 Overview

Coder is a platform that provisions remote development environments through Terraform. CVE-2026-55078 is a denial-of-service vulnerability affecting the POST /api/v2/files endpoint in Coder versions 2.17.0 through 2.29.6, 2.32.6, 2.33.7, and 2.34.1. The endpoint converts zip uploads to tar in memory via the CreateTarFromZip function. While the function enforced a per-entry size limit, it lacked an aggregate limit on total decompressed output and wrote to an unbounded in-memory buffer. An authenticated attacker with file-upload permissions can exhaust server memory by supplying a specially crafted zip archive.

Critical Impact
Authenticated users with file-upload access can trigger memory exhaustion in coderd, causing denial of service against the Coder control plane.

Affected Products

Coder versions 2.17.0 through 2.29.6
Coder versions 2.30.x through 2.32.6 and 2.33.x through 2.33.7
Coder versions 2.34.0 through 2.34.1

Discovery Timeline

2026-07-07 - CVE-2026-55078 published to the National Vulnerability Database
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55078

Vulnerability Analysis

CVE-2026-55078 is a decompression resource-exhaustion issue classified as [CWE-409] (Improper Handling of Highly Compressed Data). The vulnerable path is the file upload endpoint POST /api/v2/files in coderd, which accepts zip archives from authenticated clients and converts them into tar archives server-side.

The conversion is performed by the CreateTarFromZip function. The function iterated over each zip entry and enforced a per-entry decompressed size limit. However, it never summed sizes across entries and streamed all output into an unbounded in-memory buffer. An attacker can craft a zip archive containing many entries, each below the per-entry threshold, whose combined decompressed size exceeds available server memory.

Exploitation is limited to availability impact. The attacker must hold valid credentials with file-upload authorization. Successful exploitation causes coderd to allocate memory until the process is killed or the host degrades, disrupting workspace provisioning for all users.

Root Cause

The root cause is missing aggregate input validation during zip-to-tar conversion. Per-entry limits do not bound the total decompressed output, and the in-memory buffer used by CreateTarFromZip had no size ceiling. This design permits a compression-ratio attack similar to a zip bomb, scaled across many small entries.

Attack Vector

An attacker authenticates to a Coder deployment and issues a POST /api/v2/files request with a crafted zip archive. The server invokes CreateTarFromZip, which reads entries into memory without an overall cap. As entries decompress, the buffer grows until memory is exhausted and the coderd process becomes unresponsive or terminates.

Refer to the GitHub Security Advisory GHSA-2mg2-p7r7-g27f and the GitHub Pull Request #25877 for the technical fix details.

Detection Methods for CVE-2026-55078

Indicators of Compromise

Sudden growth in coderd process resident memory correlated with requests to POST /api/v2/files.
Repeated large or unusually structured multipart uploads from a single authenticated user or API token.
coderd process restarts, out-of-memory kills, or Kubernetes pod evictions following file upload traffic.

Detection Strategies

Instrument coderd with metrics on request body size and decompressed size for the /api/v2/files endpoint, and alert on outliers.
Correlate authentication logs with file-upload activity to identify accounts submitting anomalous zip payloads.
Review reverse-proxy access logs for POST /api/v2/files requests with high Content-Length values or repeated retries.

Monitoring Recommendations

Monitor host and container memory pressure on nodes running coderd and alert on sustained utilization above baseline.
Track API upload volume per user and per token to establish behavioral baselines for legitimate workspace activity.
Enable audit logging in Coder for file-upload actions to preserve forensic evidence of abuse.

How to Mitigate CVE-2026-55078

Immediate Actions Required

Upgrade coderd to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2 depending on your release branch.
Audit existing user accounts and API tokens with file-upload permissions and revoke any that are not required.
Place a reverse proxy in front of coderd and enforce request-body size limits until patches are applied.

Patch Information

The Coder maintainers released fixes in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The patch introduced by pull request #25877 adds a metadata preflight check that sums projected entry sizes before decompression and replaces the unbounded buffer with a streaming writer that enforces an aggregate size limit during decompression. Release artifacts are available at v2.29.17, v2.32.7, v2.33.8, and v2.34.2.

Workarounds

Restrict file-upload permissions in Coder to trusted operators only until the patched version is deployed.
Deploy a reverse proxy such as nginx or Envoy in front of coderd and enforce a client_max_body_size or equivalent request-body limit.
Apply container or process-level memory limits on coderd so exhaustion attacks trigger a bounded restart rather than host degradation.

bash

# Example nginx reverse proxy limit in front of coderd
server {
    listen 443 ssl;
    server_name coder.example.com;

    client_max_body_size 10m;

    location / {
        proxy_pass http://coderd_upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}