CVE-2026-55434

Executive Summary

CVE-2026-55434 is a denial-of-service (DoS) vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the AI Bridge provider handlers, which read request bodies using io.ReadAll without enforcing a maximum size limit. An authenticated user with AI Bridge access can send an arbitrarily large request body, causing excessive memory consumption and leading to a denial of service. The vulnerability affects Coder versions 2.33.0 through 2.33.7 and 2.34.0 through 2.34.1. Patches are available in versions 2.33.8 and 2.34.2. No known workarounds exist. The CVSS score is 6.5 (Medium), with the attack vector being network-based, requiring high privileges, and impacting only availability.

Supply Chain & Package Security

Coder is a Go-based application. The vulnerability is in the application's own code, not in a third-party package. However, organizations using Coder should verify their deployment version and apply patches promptly to prevent supply chain risks from unpatched instances.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): High (H) – The attacker must be authenticated with AI Bridge access.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The vulnerability can cause a complete denial of service.

Threat Level: Medium. Exploitation requires authentication, but the impact is a denial of service, which can disrupt development environments.

Deep Dive & Mechanics

The vulnerability is in the AI Bridge provider handlers within Coder. These handlers are responsible for processing requests from authenticated users who have AI Bridge access. The handlers use the Go standard library function io.ReadAll to read the request body. io.ReadAll reads the entire body into memory without any size limit. An attacker can send a request with an arbitrarily large body (e.g., gigabytes of data), causing the server to allocate memory until it exhausts available resources, leading to a crash or unresponsiveness.

The affected code path is in the AI Bridge provider, which is a feature introduced in Coder 2.33.0. The fix involves limiting the request body size using http.MaxBytesReader or similar mechanisms to reject oversized payloads.

Vulnerable vs. Patched Code

Vulnerable Code (Go):

func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Failed to read body", http.StatusInternalServerError)
        return
    }
    // Process body...
}

Patched Code (Go):

func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    // Limit request body to 10 MB
    r.Body = http.MaxBytesReader(w, r.Body, 10*1024*1024)
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Request body too large", http.StatusRequestEntityTooLarge)
        return
    }
    // Process body...
}

The patch introduces a size limit using http.MaxBytesReader, which returns an error if the body exceeds the specified limit, preventing memory exhaustion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Coder instance (version 2.33.0 to 2.33.7 or 2.34.0 to 2.34.1).
• Valid credentials with AI Bridge access.

Exploitation Steps:

1. Identify the AI Bridge endpoint (e.g., /api/v2/ai-bridge/...).
2. Send a POST request with an extremely large body (e.g., 1 GB of random data).
3. Monitor the server's memory usage; it will spike and eventually cause a denial of service.

Example using curl:

# Generate a 1 GB payload
dd if=/dev/zero bs=1M count=1024 | curl -X POST -H "Authorization: Bearer <token>" --data-binary @- https://coder.example.com/api/v2/ai-bridge/provider

Expected Outcome: The Coder server becomes unresponsive or crashes due to memory exhaustion.

Blue Team (Defense & Detection)

Detection:

• Monitor for requests with unusually large body sizes to AI Bridge endpoints.
• Set up alerts for memory usage spikes on Coder servers.

Mitigation:

• Apply patches to versions 2.33.8 or 2.34.2.
• If patching is not immediately possible, restrict access to AI Bridge endpoints to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block requests with body sizes exceeding a threshold (e.g., 10 MB).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v2/ai-bridge/ with Content-Length headers exceeding 10 MB.
  • Repeated requests from the same IP address with large payloads.
• System IOCs:
  • High memory usage on Coder server processes.
  • Coder service crashes or restarts.
  • Log entries indicating http: request body too large (after patching) or out of memory errors.

Detection Engineering

YARA Rule

rule CVE_2026_55434_Coder_AI_Bridge_DoS {
    meta:
        description = "Detects attempts to exploit CVE-2026-55434 by sending large request bodies to AI Bridge endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-55434"
    strings:
        $endpoint = "/api/v2/ai-bridge/" ascii wide nocase
        $large_body = { 00 00 00 00 } // Placeholder for large body detection (e.g., >10MB)
    condition:
        $endpoint and filesize > 10000000
}

Sigma Rule

title: Coder AI Bridge Large Request Body DoS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Coder AI Bridge endpoints with excessively large body sizes
author: Valters IT
date: 2025/04/10
references:
    - CVE-2026-55434
logsource:
    category: webserver
    product: coder
detection:
    selection:
        cs-uri-query|contains: "/api/v2/ai-bridge/"
        sc-status: 200
        cs-bytes|gte: 10000000
    condition: selection
falsepositives:
    - Legitimate large data uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55434 Coder AI Bridge DoS Attempt"; flow:to_server; content:"/api/v2/ai-bridge/"; http_uri; byte_test:10,>,10,string,dec; reference:cve,2026-55434; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to version 2.33.8 or 2.34.2 (or later).
2. If upgrading is not possible, restrict access to AI Bridge endpoints using network policies or authentication controls.

Long-Term Measures:

• Implement input validation and size limits on all request body handlers.
• Conduct regular security audits of custom handlers.
• Monitor for unusual memory usage patterns.

Workarounds: None available.

Valters IT