CVE-2026-55434

Name of the Vulnerable Software and Affected Versions Coder versions 2.33.0 through 2.33.7 Coder versions 2.34.0 through 2.34.1

Description AI Bridge provider handlers read request bodies using io.ReadAll without enforcing a maximum size. An authenticated user with AI Bridge access can send an arbitrarily large or chunked body to an AI Bridge provider endpoint, such as /api/v2/aibridge/anthropic/v1/messages, which causes heap memory to grow until the operating system terminates the process. Since AI Bridge runs in-process with coderd, this results in a denial of service that crashes the entire control plane, including the API, workspace coordinator, and DERP relay.

Recommendations Update Coder versions 2.33.0 through 2.33.7 to version 2.33.8. Update Coder versions 2.34.0 through 2.34.1 to version 2.34.2.