CVE-2026-55434: Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

July 6, 2026 (updated July 7, 2026)

AI Bridge provider handlers read request bodies with io.ReadAll without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory.

Note: Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service).

References

github.com/advisories/GHSA-f5vp-w269-392g
github.com/coder/coder/pull/26164
github.com/coder/coder/releases/tag/v2.33.8
github.com/coder/coder/releases/tag/v2.34.2
github.com/coder/coder/security/advisories/GHSA-f5vp-w269-392g
nvd.nist.gov/vuln/detail/CVE-2026-55434

Code Behaviors & Features

Detect and mitigate CVE-2026-55434 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →