CVE-2026-55078: Anthropic Python zip decompression

Q: Is CVE-2026-55078 actively exploited?

No confirmed active exploitation of CVE-2026-55078 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55078?

1) Patch to the fixed version for your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) — all backport the metadata preflight check and streaming aggregate-size enforcement. 2) Until patched, restrict file-upload permissions (`/api/v2/files`) to trusted users only via RBAC. 3) Place a reverse proxy (e.g., nginx, Caddy) in front of coderd with a strict request-body size limit well below the 100 MiB application-level cap to reduce the effective decompression ratio an attacker can achieve. 4) Monitor coderd process memory usage and crash/restart logs for spikes correlated with file-upload API calls as a detection signal. 5) Review audit logs for repeated or anomalous `/api/v2/files` uploads from a single account, which may indicate exploitation attempts.

Q: What systems are affected by CVE-2026-55078?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, agent frameworks.

Q: What is the CVSS score for CVE-2026-55078?

CVE-2026-55078 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.60%.

CISO Take

A flaw in Coder's file-upload endpoint lets an authenticated user upload a small, highly compressible zip file that expands to an unbounded size in memory during zip-to-tar conversion, crashing the coderd control-plane process before any authorization check runs. With 5,435 downstream dependents and no CVSS-listed exploit maturity data, EPSS score, or CISA KEV listing, this reads as a low-noise but real availability risk for any organization running Coder to provision AI/ML development workspaces or LLM-serving infrastructure — repeated crashes translate directly into lost engineering time for data science and ML teams who depend on those workspaces being up. Exploitation requires only a valid file-upload-capable account, no special AI/ML knowledge, and no public PoC or Nuclei template currently exists, keeping opportunistic exploitation likelihood low. Patch immediately to v2.34.2 (or the matching 2.33.8/2.32.7/2.29.17 backport for your release line); until patched, restrict file-upload permissions to trusted users and place a reverse proxy with request-body size limits in front of coderd, and watch for repeated coderd OOM/crash events correlated with `/api/v2/files` POST requests as a detection signal.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact with no confidentiality or integrity loss. Exploitability is low-complexity but gated behind authenticated file-upload access, which narrows the practical attacker pool to insiders, compromised low-privilege accounts, or malicious contractors rather than anonymous internet attackers. No EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template exist, so there is no evidence of active or imminent exploitation. The package risk score (31/100) and lack of an OpenSSF Scorecard entry suggest this is not treated as a high-priority hardening target by the ecosystem, but the sheer downstream dependent count (5,435) means the blast radius across organizations running self-hosted Coder is non-trivial. Repeatability of the attack (any authenticated user can crash coderd repeatedly) elevates this from a one-off nuisance to a sustained availability risk if left unpatched.

How does the attack unfold?

Initial Access

Attacker obtains or already holds an authenticated account with file-upload permission on the Coder deployment.

Crafting

Attacker builds a zip archive with many highly compressible entries that stays under the 100 MiB upload limit but expands massively when decompressed.

Exploitation

Attacker submits the crafted zip to POST /api/v2/files, triggering unbounded in-memory decompression in CreateTarFromZip before any RBAC check occurs.

AML.T0029

Impact

coderd exhausts memory and crashes, denying all users access to their Coder-managed workspaces; attacker repeats the upload to sustain the outage.

AML.T0029

Initial Access

Attacker obtains or already holds an authenticated account with file-upload permission on the Coder deployment.

Crafting

Attacker builds a zip archive with many highly compressible entries that stays under the 100 MiB upload limit but expands massively when decompressed.

Exploitation

Attacker submits the crafted zip to POST /api/v2/files, triggering unbounded in-memory decompression in CreateTarFromZip before any RBAC check occurs.

AML.T0029

Impact

coderd exhausts memory and crashes, denying all users access to their Coder-managed workspaces; attacker repeats the upload to sustain the outage.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed 3d ago 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

1) Patch to the fixed version for your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) — all backport the metadata preflight check and streaming aggregate-size enforcement. 2) Until patched, restrict file-upload permissions (/api/v2/files) to trusted users only via RBAC. 3) Place a reverse proxy (e.g., nginx, Caddy) in front of coderd with a strict request-body size limit well below the 100 MiB application-level cap to reduce the effective decompression ratio an attacker can achieve. 4) Monitor coderd process memory usage and crash/restart logs for spikes correlated with file-upload API calls as a detection signal. 5) Review audit logs for repeated or anomalous /api/v2/files uploads from a single account, which may indicate exploitation attempts.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS API AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MANAGE-4.1 - Post-deployment monitoring and resilience of AI systems and infrastructure

Frequently Asked Questions

What is CVE-2026-55078?

A flaw in Coder's file-upload endpoint lets an authenticated user upload a small, highly compressible zip file that expands to an unbounded size in memory during zip-to-tar conversion, crashing the coderd control-plane process before any authorization check runs. With 5,435 downstream dependents and no CVSS-listed exploit maturity data, EPSS score, or CISA KEV listing, this reads as a low-noise but real availability risk for any organization running Coder to provision AI/ML development workspaces or LLM-serving infrastructure — repeated crashes translate directly into lost engineering time for data science and ML teams who depend on those workspaces being up. Exploitation requires only a valid file-upload-capable account, no special AI/ML knowledge, and no public PoC or Nuclei template currently exists, keeping opportunistic exploitation likelihood low. Patch immediately to v2.34.2 (or the matching 2.33.8/2.32.7/2.29.17 backport for your release line); until patched, restrict file-upload permissions to trusted users and place a reverse proxy with request-body size limits in front of coderd, and watch for repeated coderd OOM/crash events correlated with `/api/v2/files` POST requests as a detection signal.

Is CVE-2026-55078 actively exploited?

No confirmed active exploitation of CVE-2026-55078 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55078?

1) Patch to the fixed version for your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) — all backport the metadata preflight check and streaming aggregate-size enforcement. 2) Until patched, restrict file-upload permissions (`/api/v2/files`) to trusted users only via RBAC. 3) Place a reverse proxy (e.g., nginx, Caddy) in front of coderd with a strict request-body size limit well below the 100 MiB application-level cap to reduce the effective decompression ratio an attacker can achieve. 4) Monitor coderd process memory usage and crash/restart logs for spikes correlated with file-upload API calls as a detection signal. 5) Review audit logs for repeated or anomalous `/api/v2/files` uploads from a single account, which may indicate exploitation attempts.

What systems are affected by CVE-2026-55078?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, agent frameworks.

What is the CVSS score for CVE-2026-55078?

CVE-2026-55078 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.60%.

What is the AI security impact?

Affected AI Architectures

training pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

### Summary `POST /api/v2/files` converts zip uploads to tar in memory via `CreateTarFromZip`, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. > **Note:** Exploitation requires authenticated file-upload access and the impact is limited to availability (denial of service). ### Impact An authenticated user could upload a zip within the 100 MiB upload limit but containing many highly compressible entries whose decompressed size exhausted memory, crashing `coderd` before any RBAC check. Repeated requests could keep the service unavailable. This is a denial of service; it does not allow data disclosure or code execution. ### Patches The fix adds a metadata preflight check that sums projected entry sizes and a streaming writer that enforces the aggregate limit during decompression. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict file-upload permissions to trusted users or place a reverse proxy with request-body size limits in front of `coderd`. ### Resources - Fix: #25877 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22438) for independently disclosing this issue!

Exploitation Scenario

An authenticated user with file-upload access to a Coder deployment — for example, a contractor with a low-privilege account, or an attacker who has phished/stolen valid credentials — crafts a zip archive containing many highly compressible entries (a classic decompression-bomb pattern) that stays within the 100 MiB upload size limit but expands to gigabytes when decompressed. They submit this via `POST /api/v2/files`, triggering `CreateTarFromZip`, which writes the fully decompressed output to an unbounded in-memory buffer with no aggregate size check. The coderd process exhausts available memory and crashes, taking down workspace access for every user on that deployment — including AI/ML engineers mid-training-run or mid-development. The attacker repeats the upload after each restart to sustain the outage, achieving a low-effort, low-cost denial-of-service against the entire platform.

Weaknesses (CWE)

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) Primary CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) CWE-770 Allocation of Resources Without Limits or Throttling

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification): The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Source: MITRE CWE corpus.