CVE-2026-55079: coder

Vulnerability summary

CVE-2026-55079 is a medium (CVSS 6.5) vulnerability in coder. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.2% of scored vulnerabilities.

Timeline

1. 07-07-2026
   PublishedVulnerability first disclosed.
2. 08-07-2026
   Last modifiedVulnerability information updated.

Description

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.

• CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.