CVE-2026-55434

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55434
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55434.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55434
Aliases
Published
2026-07-07T20:14:00.531Z
Modified
2026-07-10T04:02:54.219961916Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
Details

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with io.ReadAll without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service). Versions 2.33.8 and 2.34.2 patch the issue. No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55434.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/coder/coder

Affected ranges

Type
GIT
Repo
https://github.com/coder/coder
Events
Introduced
f009c17217e6bad9a61ba511d23735bc1ce94da0
Fixed
f9486be96df392b017941ff6a6bd43a629adc86c
Introduced
3006da5ef7a9c27755aa5b2f3f5f05d2c8971a58
Fixed
d7774e5c4ca222ee89a8b6aa82b61c1f8bb81d1f
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "2.33.0"
        },
        {
            "fixed": "2.33.8"
        },
        {
            "introduced": "2.34.0"
        },
        {
            "fixed": "2.34.2"
        }
    ]
}

Affected versions

v2.*
v2.33.0
v2.33.1
v2.33.2
v2.33.3
v2.33.4
v2.33.5
v2.33.6
v2.33.7
v2.34.0
v2.34.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55434.json"