{"id":"GHSA-2mg2-p7r7-g27f","summary":"Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service","details":"### Summary\n\n`POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer.\n\n\u003e **Note:** Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service).\n\n### Impact\n\nAn authenticated user could upload a zip within the 100 MiB upload limit but containing many highly compressible entries whose decompressed size exhausted memory, crashing `coderd` before any RBAC check. Repeated requests could keep the service unavailable. This is a denial of service; it does not allow data disclosure or code execution.\n\n### Patches\n\nThe fix adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression.\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) |\n| 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) |\n| 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) |\n| 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |\n\n### Workarounds\n\nRestrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.\n\n### Resources\n\n- Fix: #25877\n\n### Credits\n\nCoder would like to thank Anthropic's Security Team (ANT-2026-22438) for independently disclosing this issue!","aliases":["CVE-2026-55078","GO-2026-5916"],"modified":"2026-07-07T20:41:21.989524235Z","published":"2026-07-06T21:06:45Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-06T21:06:45Z","nvd_published_at":null,"cwe_ids":["CWE-409","CWE-770"]},"references":[{"type":"WEB","url":"https://github.com/coder/coder/security/advisories/GHSA-2mg2-p7r7-g27f"},{"type":"WEB","url":"https://github.com/coder/coder/pull/25877"},{"type":"PACKAGE","url":"https://github.com/coder/coder"}],"affected":[{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.34.0"},{"fixed":"2.34.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2mg2-p7r7-g27f/GHSA-2mg2-p7r7-g27f.json"}},{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.33.0"},{"fixed":"2.33.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2mg2-p7r7-g27f/GHSA-2mg2-p7r7-g27f.json"}},{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.30.0"},{"fixed":"2.32.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2mg2-p7r7-g27f/GHSA-2mg2-p7r7-g27f.json"}},{"package":{"name":"github.com/coder/coder/v2","ecosystem":"Go","purl":"pkg:golang/github.com/coder/coder/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.17.0"},{"fixed":"2.29.17"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2mg2-p7r7-g27f/GHSA-2mg2-p7r7-g27f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}