CVE-2026-126405 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Coder reads Web Push endpoint responses with no size limit or timeout, so a registered subscription pointing at a server that returns an endless body exhausts memory. The result is that the API, dashboard and workspace connections crash.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Coder deployment in the affected version ranges is exposed, because any authenticated user can register a Web Push subscription pointing at a server they control. Exposure requires a logged-in account, so deployments where only trusted staff have accounts carry less risk, but the flaw still lets any such user take the API down.
Not affected if auth-required, default-config
Who cares coder, kubernetes, self-hosted
coder version and compare it to the ranges below.2.29.24 for the 2.21.x to 2.29.x line2.34.16 for the 2.30.x to 2.34.x line2.36.11 for the 2.35.x to 2.36.x line2.37.8 for the 2.37.x line2.38.4 for the 2.38.x lineCoder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.