CVE-2026-55434 | Coder allows organizations to provision remote development e… | CVSS 6.5 MEDIUM

Description

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service). Versions 2.33.8 and 2.34.2 patch the issue. No known workarounds are available.

Metadata

CVE ID: CVE-2026-55434
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 21:59 UTC
Published: 2026-07-07 20:14 UTC
Last updated: 2026-07-08 14:15 UTC
Primary CWE: CWE-770
CWE-770: Allocation of Resources Without Limits or Throttlin…
Vendor / Product: coder / coder
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
coder	coder	—	>= 2.34.0, < 2.34.2, >= 2.33.0, < 2.33.8

Weakness (CWE)

CWE	Source	Description
CWE-770	cna	CWE-770: Allocation of Resources Without Limits or Throttling

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References (4)

https://github.com/coder/coder/security/advisories/GHSA-f5vp-w269-392g https://github.com/coder/coder/security/advisories/GHSA-f5vp-w269-392g
https://github.com/coder/coder/pull/26164 https://github.com/coder/coder/pull/26164
https://github.com/coder/coder/releases/tag/v2.33.8 https://github.com/coder/coder/releases/tag/v2.33.8
https://github.com/coder/coder/releases/tag/v2.34.2 https://github.com/coder/coder/releases/tag/v2.34.2