Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

Summary

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.

Timeline

1. Jul 7, 2026, 10:47 PM UTCCVE published
2. Jul 8, 2026, 1:54 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jul 8, 2026, 1:55 PM UTCRecord last updated

Affected versions

• coder coder

  From 2.34.0 · fixed in 2.34.2; From 2.33.0 · fixed in 2.33.8; From 2.30.0 · fixed in 2.32.7; From 2.17.0 · fixed in 2.29.17

• github.com/coder/coderGo

  All versions

• github.com/coder/coder/v2Go

  From 2.17.0 · fixed in 2.29.17; From 2.30.0 · fixed in 2.32.7; From 2.33.0 · fixed in 2.33.8; From 2.34.0 · fixed in 2.34.2

• github.com/coder/coder/v2Go

  From 2.34.0 · fixed in 2.34.2

• github.com/coder/coder/v2Go

  From 2.33.0 · fixed in 2.33.8

• github.com/coder/coder/v2Go

  From 2.30.0 · fixed in 2.32.7

• github.com/coder/coder/v2Go

  From 2.17.0 · fixed in 2.29.17

References 6