CyberRota Analysis
AI-GeneratedThe AI Bridge provider handlers in Coder versions 2.33.0 through 2.33.7 and 2.34.0 through 2.34.1 are vulnerable to a denial-of-service attack due to the use of `io.ReadAll` without a size limit, allowing authenticated users to send excessively large request bodies that can exhaust system memory. Organizations using these versions should prioritize upgrading to 2.33.8 or 2.34.2 to mitigate the risk of service disruption. This vulnerability primarily affects users with AI Bridge access, making it critical for teams managing remote development environments to address promptly.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service). Versions 2.33.8 and 2.34.2 patch the issue. No known workarounds are available.
Related CVEs
Other vulnerabilities affecting the same vendor(s)