{"id":"CVE-2026-126405","kind":"vulnerability","aliases":["CVE-2026-126405"],"related":[],"title":"Coder: unbounded Web Push response read lets any user crash the server","description":"Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections.","summary":"Coder reads Web Push endpoint responses with no size limit or timeout, so a registered subscription pointing at a server that returns an endless body exhausts memory. The result is that the API, dashboard and workspace connections crash.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","infrastructure","kubernetes","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the running Coder version with `coder version` and compare it to the ranges below.\n- Review whether users can create Web Push subscriptions via POST /api/v2/users/{user}/webpush/subscription.","fix":"- Coder `2.29.24` for the 2.21.x to 2.29.x line\n- Coder `2.34.16` for the 2.30.x to 2.34.x line\n- Coder `2.36.11` for the 2.35.x to 2.36.x line\n- Coder `2.37.8` for the 2.37.x line\n- Coder `2.38.4` for the 2.38.x line","status":"open","published_at":"2026-11-13T10:17:45+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","triaged_at":"2026-11-13T10:53:13+00:00","updated_at":"2026-11-13T10:53:13+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T10:53:13Z","model":"claude-haiku-5-5","output":{"fix":"- Coder `2.29.24` for the 2.21.x to 2.29.x line\n- Coder `2.34.16` for the 2.30.x to 2.34.x line\n- Coder `2.36.11` for the 2.35.x to 2.36.x line\n- Coder `2.37.8` for the 2.37.x line\n- Coder `2.38.4` for the 2.38.x line","reach":"internet","title":"Coder: unbounded Web Push response read lets any user crash the server","impact":"medium","summary":"Coder reads Web Push endpoint responses with no size limit or timeout, so a registered subscription pointing at a server that returns an endless body exhausts memory. The result is that the API, dashboard and workspace connections crash.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["coder","self-hosted","kubernetes"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user crashes API, dashboard and workspace connections via memory exhaustion","analyst_note":"","how_to_check":"- Check the running Coder version with `coder version` and compare it to the ranges below.\n- Review whether users can create Web Push subscriptions via POST /api/v2/users/{user}/webpush/subscription.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Any Coder deployment in the affected version ranges is exposed, because any authenticated user can register a Web Push subscription pointing at a server they control. Exposure requires a logged-in account, so deployments where only trusted staff have accounts carry less risk, but the flaw still lets any such user take the API down.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4720,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126405':15A,18A '-2026':14A,17A '/api/v2/users':105C '/webpush/subscription':107C '2.21.0':64C '2.29.24':66C '2.30.0':67C '2.34.16':69C '2.35.0':70C '2.36.11':72C '2.37.0':73C '2.37.8':75C '2.38.0':77C '2.38.4':79C 'api':57B,122C 'authent':97C 'bodi':49B,115C 'client':94C 'coder':1A,19B,25B,63C 'coderd':117C 'connect':61B,126C 'crash':10A,62B,120C 'cve':13A,16A 'dashboard':58B,123C 'endless':48B,114C 'endpoint':29B,83C 'exhaust':50B,116C 'host':24B 'infrastructur':20B 'io.readall':88C 'kubernet':21B 'let':7A 'limit':34B,92C 'memori':51B,118C 'point':41B,108C 'post':104C 'push':4A,28B,82C 'read':6A,26B,80C 'regist':39B,100C 'respons':5A,30B,84C 'result':53B 'return':46B,112C 'self':23B 'self-host':22B 'server':12A,44B,111C 'size':33B,91C 'subscript':40B,102C 'timeout':36B,95C 'unbound':2A 'user':9A,98C,106C 'via':103C 'web':3A,27B,81C 'webpushsend':86C 'without':89C 'workspac':60B,125C","nicknames":[],"mitigations":[],"who_affected":"Any Coder deployment in the affected version ranges is exposed, because any authenticated user can register a Web Push subscription pointing at a server they control. Exposure requires a logged-in account, so deployments where only trusted staff have accounts carry less risk, but the flaw still lets any such user take the API down.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coder","high","infrastructure","kubernetes","selfhosted"],"campaign_type":null,"search_a":"'-126405':15A,18A '-2026':14A,17A 'coder':1A 'crash':10A 'cve':13A,16A 'let':7A 'push':4A 'read':6A 'respons':5A 'server':12A 'unbound':2A 'user':9A 'web':3A","search_b":"'api':57B 'bodi':49B 'coder':19B,25B 'connect':61B 'crash':62B 'dashboard':58B 'endless':48B 'endpoint':29B 'exhaust':50B 'host':24B 'infrastructur':20B 'kubernet':21B 'limit':34B 'memori':51B 'point':41B 'push':28B 'read':26B 'regist':39B 'respons':30B 'result':53B 'return':46B 'self':23B 'self-host':22B 'server':44B 'size':33B 'subscript':40B 'timeout':36B 'web':27B 'workspac':60B","search_c":"'/api/v2/users':105C '/webpush/subscription':107C '2.21.0':64C '2.29.24':66C '2.30.0':67C '2.34.16':69C '2.35.0':70C '2.36.11':72C '2.37.0':73C '2.37.8':75C '2.38.0':77C '2.38.4':79C 'api':122C 'authent':97C 'bodi':115C 'client':94C 'coder':63C 'coderd':117C 'connect':126C 'crash':120C 'dashboard':123C 'endless':114C 'endpoint':83C 'exhaust':116C 'io.readall':88C 'limit':92C 'memori':118C 'point':108C 'post':104C 'push':82C 'read':80C 'regist':100C 'respons':84C 'return':112C 'server':111C 'size':91C 'subscript':102C 'timeout':95C 'user':98C,106C 'via':103C 'web':81C 'webpushsend':86C 'without':89C 'workspac':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T12:03:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126405","severity":null,"published_at":"2026-11-13T10:17:45+00:00","modified_at":"2026-11-13T10:17:45+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","fetched_at":"2026-11-13T10:47:19+00:00","note":null}],"documents":[{"id":145053,"url":"https://github.com/coder/coder/security/advisories/GHSA-64xh-rgcx-gg65","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T12:03:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145054,"url":"https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-memory-exhaustion-dos-via-web-push","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}