Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-55078 is a medium-severity Data Amplification (CWE-409) vulnerability in Coder Coder. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42131
Vulnerability Data
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit…
more
but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables an authenticated attacker to trigger an unbounded in-memory buffer allocation via a crafted ZIP upload, directly causing an application exhaustion condition that maps to T1499.004 (Endpoint Denial of Service: Application or System Exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection via a reverse proxy with request-body size limits directly blocks the unbounded zip-to-tar decompression before it reaches coderd.
Least privilege restricts authenticated file-upload access to only trusted users, eliminating the required attack vector for CVE-2026-55078.
Information input validation enforces aggregate size limits on decompressed archive content, preventing the memory-exhaustion condition described in the CVE.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring capacity and taking action to maintain availability directly reduces unchecked resource allocation.
Secure-development practices include input-validation and resource-limit checks that prevent improper handling of compressed data.
Runtime monitoring of compute resources can detect exhaustion caused by decompression bombs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Baseline comparison of CPU, memory and bandwidth usage helps surface uncontrolled resource allocations before they cause service degradation.
Security testing can uncover decompression-bomb vulnerabilities before release.
Capacity projections and elasticity measures ensure that allocation requests are bounded and can be throttled, reducing the window in which an attacker can force unbounded resource reservations.
Defining retention periods and deletion schedules for backup copies prevents indefinite accumulation of data on storage media without corresponding resource-management controls.
Redundancy helps availability but does not address the root cause of the weakness.
Secure development lifecycle includes input validation and resource-limit checks that mitigate data-amplification attacks.