CVE-2026-55078

The record

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.

Affected packages

Related vulnerabilities

• CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
• CVE-2026-112892 Pillow is a Python imaging library. CWE-409
• CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
• CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
• CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409
• CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. CWE-409
• CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. CWE-409
• CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow… CWE-409