Memory Exhaustion in Coder via Unbounded Web Push Responses

Executive Summary

CVE-2026-126405 is a memory exhaustion vulnerability in Coder versions 2.21.0 to 2.38.3. It occurs because the system reads Web Push endpoint responses without size limits or timeouts using io.ReadAll. An authenticated user can exploit this by registering a malicious subscription pointing to a server returning an endless response, causing the coderd process to crash and making the entire system unavailable.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual memory usage in the coderd process or excessive network traffic from authenticated users registering Web Push subscriptions. Check logs for POST requests to /api/v2/users/{user}/webpush/subscription with external endpoint URLs. Use system monitoring tools like top, htop, or ps to observe memory consumption spikes in the coderd service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to crash the Coder platform by triggering memory exhaustion. This results in denial of service for all users, disrupting API access, dashboard functionality, and workspace connections. The impact is system-wide and requires immediate patching to restore normal operations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Coder to a patched version (2.38.4, 2.37.8, 2.36.11, 2.34.16, or 2.29.24) to apply the fix that limits response size and sets a timeout. If upgrading is not immediately possible, disable Web Push functionality in Coder or restrict network access to the Web Push subscription endpoint to prevent external abuse.

Useful 0 Not Useful 0