V2: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service (CVE-2026-55078)
### Summary `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. > **Note:** Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). ### Impact An authenticated user could upload a zip within the 100 MiB upload limit but containing many highly compressible entries whose decompressed size exhausted memory, crashing `coderd` before any RBAC check. Repeated requests could keep the service unavailable. This is a denial of service; it does not allow data disclosure or code execution. ### Patches The fix adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`. ### Resources - Fix: #25877 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22438) for independently disclosing this issue!
AI Analysis
Technical Summary
The vulnerability in github.com/coder/coder/v2 involves the POST /api/v2/files endpoint converting zip uploads to tar in memory without enforcing an aggregate decompressed size limit. While each zip entry has a size limit, the total decompressed size can exceed memory limits if many highly compressible entries are included. This causes the coderd process to crash before RBAC checks, resulting in denial of service. The fix introduces a metadata preflight check summing projected entry sizes and a streaming writer enforcing the aggregate limit during decompression. Patched versions include v2.34.2, v2.33.8, v2.32.7, and v2.29.17.
Potential Impact
An authenticated user can cause a denial of service by uploading a specially crafted zip file that decompresses to a very large size, exhausting server memory and crashing the coderd process. This leads to service unavailability. There is no impact on confidentiality or integrity, as the vulnerability does not allow data disclosure or code execution.
Mitigation Recommendations
Apply the official patches available in versions v2.34.2, v2.33.8, v2.32.7, and v2.29.17 or later. Until patched, restrict file-upload permissions to trusted users only or deploy a reverse proxy with request-body size limits in front of coderd to limit upload sizes. The vendor has provided official fixes for all supported release lines.
V2: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service (CVE-2026-55078)
Description
### Summary `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. > **Note:** Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). ### Impact An authenticated user could upload a zip within the 100 MiB upload limit but containing many highly compressible entries whose decompressed size exhausted memory, crashing `coderd` before any RBAC check. Repeated requests could keep the service unavailable. This is a denial of service; it does not allow data disclosure or code execution. ### Patches The fix adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`. ### Resources - Fix: #25877 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22438) for independently disclosing this issue!
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in github.com/coder/coder/v2 involves the POST /api/v2/files endpoint converting zip uploads to tar in memory without enforcing an aggregate decompressed size limit. While each zip entry has a size limit, the total decompressed size can exceed memory limits if many highly compressible entries are included. This causes the coderd process to crash before RBAC checks, resulting in denial of service. The fix introduces a metadata preflight check summing projected entry sizes and a streaming writer enforcing the aggregate limit during decompression. Patched versions include v2.34.2, v2.33.8, v2.32.7, and v2.29.17.
Potential Impact
An authenticated user can cause a denial of service by uploading a specially crafted zip file that decompresses to a very large size, exhausting server memory and crashing the coderd process. This leads to service unavailability. There is no impact on confidentiality or integrity, as the vulnerability does not allow data disclosure or code execution.
Mitigation Recommendations
Apply the official patches available in versions v2.34.2, v2.33.8, v2.32.7, and v2.29.17 or later. Until patched, restrict file-upload permissions to trusted users only or deploy a reverse proxy with request-body size limits in front of coderd to limit upload sizes. The vendor has provided official fixes for all supported release lines.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2mg2-p7r7-g27f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55078"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4c340327e9c797195f5f3b
Added to database: 07/06/2026, 23:02:27 UTC
Last enriched: 07/06/2026, 23:12:26 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.