CVE-2026-55434
Coder allows organizations to provision remote development environments via Terraform.
Does this matter?
Lower severity and a low EPSS score (0.55%). Track it; it rarely justifies an emergency change on its own.
Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service). Versions 2.33.8 and 2.34.2 patch the issue. No known workarounds are available.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.55% probability · 44th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- coder/coder
- Source
- security-advisories@github.com
References
- https://github.com/coder/coder/pull/26164Issue Tracking, Patch
- https://github.com/coder/coder/releases/tag/v2.33.8Release Notes
- https://github.com/coder/coder/releases/tag/v2.34.2Release Notes
- https://github.com/coder/coder/security/advisories/GHSA-f5vp-w269-392gPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.