CyberRota Analysis
AI-GeneratedThe vulnerability affects Coder versions 2.17.0 through 2.29.6 and 2.32.6 through 2.34.1, allowing authenticated users to exploit the `POST /api/v2/files` endpoint by uploading zip files that can lead to a denial of service due to unbounded memory consumption. Organizations using these versions should prioritize patching to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2, or implement workarounds such as restricting upload permissions or using a reverse proxy with size limits. This issue primarily impacts availability and should be addressed by teams managing remote development environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. As a workaround, restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`.
Related CVEs
Other vulnerabilities affecting the same vendor(s)