GHSA-f962-qm93-mj4c

Source

https://github.com/advisories/GHSA-f962-qm93-mj4c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f962-qm93-mj4c/GHSA-f962-qm93-mj4c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f962-qm93-mj4c

Aliases

Published

2026-07-06T20:54:41Z

Modified

2026-07-07T16:11:13.492500722Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

Details

Summary

NewDataBuilder in provisionersdk/proto/dataupload.go allocated a byte slice using the client-supplied FileSize from a DataUpload message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the FileSize value itself was unconstrained

Impact

An authenticated user able to reach the provisioner daemon serve endpoint could send a roughly 50-byte message declaring a huge FileSize (for example 1 TiB), triggering an unrecoverable Go out-of-memory abort that terminates coderd. This is a single-message denial of service affecting the entire deployment.

Patches

The fix validates FileSize against an upper bound (MaxFileSize = 100 MiB) before allocation.

The fix was backported to all supported release lines:

| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |

Workarounds

Restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.

Resources

Fix: #25710

Credits

Coder would like to thank Anthropic's Security Team (ANT-2026-22442) for independently disclosing this issue!

Database specific

{
    "severity": "MODERATE",
    "nvd_published_at": null,
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-789"
    ],
    "github_reviewed_at": "2026-07-06T20:54:41Z"
}

References

Affected packages

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.34.0

Fixed

2.34.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f962-qm93-mj4c/GHSA-f962-qm93-mj4c.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.33.0

Fixed

2.33.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f962-qm93-mj4c/GHSA-f962-qm93-mj4c.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.30.0

Fixed

2.32.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f962-qm93-mj4c/GHSA-f962-qm93-mj4c.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.24.0

Fixed

2.29.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f962-qm93-mj4c/GHSA-f962-qm93-mj4c.json"