GHSA-f962-qm93-mj4c
MEDIUMCoder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
Blast Radius
github.com/coder/coder/v2🐹github.com/coder/coder/v2🐹github.com/coder/coder/v2🐹github.com/coder/coder/v2Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
NewDataBuilder in provisionersdk/proto/dataupload.go allocated a byte slice using the client-supplied FileSize from a DataUpload message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the FileSize value itself was unconstrained
Impact
An authenticated user able to reach the provisioner daemon serve endpoint could send a roughly 50-byte message declaring a huge FileSize (for example 1 TiB), triggering an unrecoverable Go out-of-memory abort that terminates coderd. This is a single-message denial of service affecting the entire deployment.
Patches
The fix validates FileSize against an upper bound (MaxFileSize = 100 MiB) before allocation.
The fix was backported to all supported release lines:
Workarounds
Restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts.
Resources
- Fix: #25710
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22442) for independently disclosing this issue!
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/coder/coder/v2 | ≥ 2.34.0&&< 2.34.2 | 2.34.2 |
| 🐹Go | github.com/coder/coder/v2 | ≥ 2.33.0&&< 2.33.8 | 2.33.8 |
| 🐹Go | github.com/coder/coder/v2 | ≥ 2.30.0&&< 2.32.7 | 2.32.7 |
| 🐹Go | github.com/coder/coder/v2 | ≥ 2.24.0&&< 2.29.17 | 2.29.17 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/coder/coder/v2. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/coder/coder/v2 to 2.34.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-f962-qm93-mj4c is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-f962-qm93-mj4c is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-f962-qm93-mj4c. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-f962-qm93-mj4c in your dependencies?
O3 detects GHSA-f962-qm93-mj4c across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.