The NewDataBuilder function in provisionersdk/proto/dataupload.go of github.com/coder/coder/v2 allocates a byte slice using the client-supplied FileSize from a DataUpload message without enforcing an upper bound. Although the DRPC wire protocol limits message size to 4 MiB, the FileSize field itself was unconstrained, allowing an authenticated user to specify an excessively large value (e.g., 1 TiB). This causes the provisioner daemon to allocate excessive memory, leading to an unrecoverable out-of-memory abort that terminates the coderd process, resulting in a denial of service for the entire deployment. The vulnerability is tracked as CVE-2026-55079 and CWE-789 (Uncontrolled Memory Allocation). Fixes validate FileSize against a 100 MiB maximum and have been backported to supported release lines including 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Workarounds include restricting access to the provisioner daemon serve endpoint to trusted service accounts.

An authenticated user with access to the provisioner daemon serve endpoint can send a specially crafted DataUpload message with a large FileSize value, causing the provisioner daemon to allocate excessive memory. This triggers an out-of-memory abort in the Go runtime, terminating the coderd process and causing a denial of service affecting the entire deployment. There is no impact on confidentiality or integrity, only availability is affected.

A fix is available and has been backported to all supported release lines: 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Users should upgrade to these patched versions to remediate the vulnerability. As a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts to prevent unauthorized exploitation.