CVE-2026-55434

MediumCVSS 6.5/10Last modified Jul 8, 2026

Description

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service). Versions 2.33.8 and 2.34.2 patch the issue. No known workarounds are available.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2026
Last modified: Jul 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-554355.4Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32 CVE-2026-554367.4Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32 CVE-2026-554375.4Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 CVE-2026-554386.8Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 CVE-2026-554395.5Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authent CVE-2026-55448.8A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. The impacted element is an unknown function of the file /CVE-2026-554406.5Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in CVE-2026-554418.6mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool CVE-2026-554425.3The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version CVE-2026-554435.5LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesys CVE-2026-554445.3The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RS CVE-2026-554459.3Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middlewa