Denial of Service Vulnerability in Coder's Remote Development Environments
CVE-2026-55434
6.5MEDIUM
What is CVE-2026-55434?
A vulnerability in Coder's provision of remote development environments via Terraform allows authenticated users with AI Bridge access to send excessively large request bodies. This is due to the use of io.ReadAll without a size limit in the AI Bridge provider handlers. Consequently, attackers can exploit this flaw to exhaust system memory, leading to service unavailability. Users are urged to upgrade to versions 2.33.8 or 2.34.2 to mitigate this issue, as no workarounds are available.
Affected Version(s)
coder >= 2.34.0, < 2.34.2 < 2.34.0, 2.34.2
coder >= 2.33.0, < 2.33.8 < 2.33.0, 2.33.8