CVE-2026-55079: Coder Coder DOS Vulnerability

CVE-2026-55079 Overview

CVE-2026-55079 is a memory allocation vulnerability in Coder, an open-source platform that provisions remote development environments through Terraform. The flaw exists in the NewDataBuilder function within provisionersdk/proto/dataupload.go. The function allocates a byte slice using the client-supplied FileSize value from a DataUpload message without enforcing an upper-bound check. Although the DRPC wire limit is 4 MiB, the FileSize field itself was unconstrained, enabling an authenticated client to trigger excessive memory allocation. The issue affects Coder versions from 2.24.0 up to the fixed releases 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

Critical Impact
An authenticated attacker can send a crafted DataUpload message with an inflated FileSize value, forcing the provisioner daemon to allocate excessive memory and causing a denial-of-service condition [CWE-789].

Affected Products

Coder versions 2.24.0 through 2.29.6
Coder versions 2.30.0 through 2.32.6, 2.33.0 through 2.33.7
Coder versions 2.34.0 through 2.34.1

Discovery Timeline

2026-07-08 - CVE-2026-55079 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55079

Vulnerability Analysis

Coder provisions remote development workspaces using Terraform. Provisioner daemons communicate with the Coder server using DRPC, exchanging DataUpload messages that carry file payloads. The NewDataBuilder function in provisionersdk/proto/dataupload.go reads the FileSize field from an incoming message and uses that value directly as the capacity for an in-memory byte slice.

Because the code performed no sanity check on FileSize, a client could submit a value far greater than any realistic payload. The Go runtime then attempts the allocation, consuming host memory until the process is killed or the system becomes unresponsive. This is classified as memory allocation with excessive size value [CWE-789].

Root Cause

The root cause is missing input validation on a length field received over the network. The DRPC transport enforces a 4 MiB message-size ceiling, which the developers appear to have relied on implicitly. However, FileSize is a semantic field inside the payload and is not bound by the transport limit. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 introduces a MaxFileSize = 100 MiB constant and validates FileSize against this ceiling before allocating memory.

Attack Vector

Exploitation requires network access to the provisioner daemon serve endpoint and valid credentials to authenticate as a provisioner daemon. An attacker with these prerequisites sends a DataUpload protobuf message containing a FileSize value in the gigabyte or terabyte range. The vulnerable code path calls make([]byte, FileSize), causing the Coder server process to exhaust available memory. Repeated requests amplify the impact and can degrade shared infrastructure hosting the Coder control plane.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-f962-qm93-mj4c and GitHub Pull Request #25710 for technical details of the fix.

Detection Methods for CVE-2026-55079

Indicators of Compromise

Sudden spikes in resident memory usage on Coder server or provisioner daemon processes without a corresponding increase in workspace activity.
Out-of-memory (OOM) kills of the coder process in system logs (dmesg, journalctl).
Anomalous DRPC traffic to the provisioner daemon serve endpoint from unexpected source addresses or service accounts.

Detection Strategies

Inspect Coder server logs for repeated DataUpload requests followed by process restarts or crash loops.
Correlate provisioner daemon authentication events with subsequent memory pressure alerts on the same host.
Alert on Coder deployments running versions 2.24.0 through 2.34.1 that have not been patched, using software inventory tools.

Monitoring Recommendations

Monitor process-level RSS and page fault counters for coder binaries and trigger alerts on rapid growth.
Track authentication events against the provisioner daemon serve endpoint and flag connections from non-trusted service accounts.
Enable rate-limiting and audit logging on the DRPC endpoint to preserve forensic evidence of abusive DataUpload traffic.

How to Mitigate CVE-2026-55079

Immediate Actions Required

Upgrade Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2 (or later) depending on the release branch in use.
Audit which identities and service accounts hold credentials for the provisioner daemon serve endpoint and revoke unnecessary access.
Review recent Coder server logs for signs of memory-exhaustion attempts prior to patching.

Patch Information

The upstream fix is committed in GitHub Pull Request #25710 and shipped in Coder v2.29.17, v2.32.7, v2.33.8, and v2.34.2. The patch introduces MaxFileSize = 100 MiB and rejects any DataUpload message whose FileSize exceeds this bound before allocation occurs.

Workarounds

Restrict network access to the provisioner daemon serve endpoint so that only trusted provisioner daemon service accounts can reach it.
Place the Coder control plane behind a reverse proxy or service mesh that enforces mutual TLS and source-IP allow-lists.
Apply host-level memory limits (for example, systemd MemoryMax or Kubernetes resource limits) to contain the blast radius of a successful exhaustion attempt.

bash

# Example: constrain the Coder service memory ceiling via systemd override
sudo systemctl edit coder.service
# Add the following lines, then save and reload:
# [Service]
# MemoryMax=4G
# MemoryHigh=3G
sudo systemctl daemon-reload
sudo systemctl restart coder.service