Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

Description

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.

Scores

EPSS (exploitation in 30 days)

0.60% · top 51% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)All about CWE-409 and its CVEs
• CWE-770: Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs

Affected products

• coder · coder

  • affected >= 2.34.0, < 2.34.2
  • affected >= 2.33.0, < 2.33.8
  • affected >= 2.30.0, < 2.32.7
  • affected >= 2.17.0, < 2.29.17

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogithub.com/coder/coder/v2GHSA-2mg2-p7r7-g27f (opens in a new tab)

References (6)

• https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f (opens in a new tab)x_refsource_CONFIRM
• https://github.com/coder/coder/pull/25877 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.29.17 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.32.7 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.33.8 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.34.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-2mg2-p7r7-g27f (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55078](https://trackcve.app/badge/CVE-2026-55078.svg)](https://trackcve.app/cve/CVE-2026-55078)

Record last updated 8 Jul 2026, 13:55 UTC.