CVE-2026-55079: Anthropic Python unbounded FileSize

Q: Is CVE-2026-55079 actively exploited?

No confirmed active exploitation of CVE-2026-55079 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55079?

1) Patch immediately to the version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR). 2) Until patched, restrict network access to the provisioner daemon serve endpoint so only trusted provisioner daemon service accounts can reach it — do not expose it to general authenticated users. 3) Review which accounts/roles currently have the privilege level required to reach this endpoint and apply least privilege. 4) Detection: alert on `coderd` process crashes/OOM-kills in system or container logs, especially those correlating with provisioner daemon traffic spikes or unusually large declared file sizes in DataUpload messages; treat repeated crash-loops as a possible active DoS attempt.

Q: What systems are affected by CVE-2026-55079?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, cloud/agent dev-environment provisioning.

Q: What is the CVSS score for CVE-2026-55079?

CVE-2026-55079 has a CVSS v3.1 base score of 4.9 (MEDIUM). The EPSS exploitation probability is 0.61%.

CISO Take

A missing upper-bound check on the client-supplied FileSize field in Coder's provisioner daemon protocol let an authenticated, sufficiently privileged user send a roughly 50-byte message declaring an absurd file size (e.g. 1 TiB), forcing coderd to attempt a matching memory allocation and crash the entire deployment with an unrecoverable Go out-of-memory abort. This is a pure availability issue (CVSS 3.1 4.9, C:N/I:N/A:H) that requires high privileges and network reach to the provisioner daemon serve endpoint, which narrows realistic attackers to insiders, compromised provisioner service accounts, or lateral movers who already hold elevated access. There is no evidence of active exploitation (not in CISA KEV), no public exploit or Nuclei template, and no EPSS score, but the package carries 5,435 downstream dependents and 35 other known CVEs, so any organization self-hosting Coder to provision developer or AI-agent sandbox workspaces should treat this as a real single-message DoS risk against a widely deployed platform. Patch to v2.34.2 (or the backported v2.33.8 / v2.32.7 / v2.29.17 for older release lines); until patched, restrict network access to the provisioner daemon serve endpoint to trusted provisioner service accounts only and monitor coderd for OOM-kill crash-loops correlating with provisioner traffic as a detection signal.

Sources: NVD GitHub Advisory CISA KEV

What is the risk?

Medium severity (CVSS 4.9) with low practical exploitability at scale: exploitation requires an attacker to already hold high privileges (PR:H) and network access to an internal provisioner daemon serve endpoint that is not typically internet-facing. No user interaction is needed and the exploit itself is trivial to craft (~50 bytes), so once an attacker has the required access, impact is immediate and total for that deployment (full coderd crash, availability impact only). No KEV listing, no public PoC/exploit, and no EPSS data suggest this is not being actively targeted, but the wide install base (5,435 downstream dependents) and the fact this is a single-message DoS against core deployment infrastructure mean unpatched instances remain a meaningful insider/lateral-movement risk.

How does the attack unfold?

Privileged Access

Attacker already holds or obtains high-privilege authenticated access sufficient to reach the provisioner daemon serve endpoint (e.g. compromised provisioner service account or insider).

Exploitation

Attacker sends a ~50-byte DataUpload message declaring an oversized FileSize (e.g. 1 TiB) to the vulnerable NewDataBuilder handler, which lacks an upper-bound check.

Impact

coderd attempts to allocate memory matching the declared size, triggers an unrecoverable Go out-of-memory abort, and crashes the entire deployment's control plane, denying service to all users.

Privileged Access

Attacker already holds or obtains high-privilege authenticated access sufficient to reach the provisioner daemon serve endpoint (e.g. compromised provisioner service account or insider).

Exploitation

Attacker sends a ~50-byte DataUpload message declaring an oversized FileSize (e.g. 1 TiB) to the vulnerable NewDataBuilder handler, which lacks an upper-bound check.

Impact

coderd attempts to allocate memory matching the declared size, triggers an unrecoverable Go out-of-memory abort, and crashes the entire deployment's control plane, denying service to all users.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed 3d ago 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

4.9 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

1) Patch immediately to the version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR). 2) Until patched, restrict network access to the provisioner daemon serve endpoint so only trusted provisioner daemon service accounts can reach it — do not expose it to general authenticated users. 3) Review which accounts/roles currently have the privilege level required to reach this endpoint and apply least privilege. 4) Detection: alert on coderd process crashes/OOM-kills in system or container logs, especially those correlating with provisioner daemon traffic spikes or unusually large declared file sizes in DataUpload messages; treat repeated crash-loops as a possible active DoS attempt.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-55079?

A missing upper-bound check on the client-supplied FileSize field in Coder's provisioner daemon protocol let an authenticated, sufficiently privileged user send a roughly 50-byte message declaring an absurd file size (e.g. 1 TiB), forcing coderd to attempt a matching memory allocation and crash the entire deployment with an unrecoverable Go out-of-memory abort. This is a pure availability issue (CVSS 3.1 4.9, C:N/I:N/A:H) that requires high privileges and network reach to the provisioner daemon serve endpoint, which narrows realistic attackers to insiders, compromised provisioner service accounts, or lateral movers who already hold elevated access. There is no evidence of active exploitation (not in CISA KEV), no public exploit or Nuclei template, and no EPSS score, but the package carries 5,435 downstream dependents and 35 other known CVEs, so any organization self-hosting Coder to provision developer or AI-agent sandbox workspaces should treat this as a real single-message DoS risk against a widely deployed platform. Patch to v2.34.2 (or the backported v2.33.8 / v2.32.7 / v2.29.17 for older release lines); until patched, restrict network access to the provisioner daemon serve endpoint to trusted provisioner service accounts only and monitor coderd for OOM-kill crash-loops correlating with provisioner traffic as a detection signal.

Is CVE-2026-55079 actively exploited?

No confirmed active exploitation of CVE-2026-55079 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55079?

1) Patch immediately to the version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR). 2) Until patched, restrict network access to the provisioner daemon serve endpoint so only trusted provisioner daemon service accounts can reach it — do not expose it to general authenticated users. 3) Review which accounts/roles currently have the privilege level required to reach this endpoint and apply least privilege. 4) Detection: alert on `coderd` process crashes/OOM-kills in system or container logs, especially those correlating with provisioner daemon traffic spikes or unusually large declared file sizes in DataUpload messages; treat repeated crash-loops as a possible active DoS attempt.

What systems are affected by CVE-2026-55079?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, cloud/agent dev-environment provisioning.

What is the CVSS score for CVE-2026-55079?

CVE-2026-55079 has a CVSS v3.1 base score of 4.9 (MEDIUM). The EPSS exploitation probability is 0.61%.

What is the AI security impact?

Affected AI Architectures

agent frameworkscloud/agent dev-environment provisioning

What are the technical details?

Original Advisory

### Summary `NewDataBuilder` in `provisionersdk/proto/dataupload.go` allocated a byte slice using the client-supplied `FileSize` from a `DataUpload` message without an upper-bound check. Although the DRPC wire limit is 4 MiB, the `FileSize` value itself was unconstrained ### Impact An authenticated user able to reach the provisioner daemon serve endpoint could send a roughly 50-byte message declaring a huge `FileSize` (for example 1 TiB), triggering an unrecoverable Go out-of-memory abort that terminates `coderd`. This is a single-message denial of service affecting the entire deployment. ### Patches The fix validates `FileSize` against an upper bound (`MaxFileSize = 100 MiB`) before allocation. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts. ### Resources - Fix: #25710 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22442) for independently disclosing this issue!

Exploitation Scenario

An attacker who has obtained credentials for an account with sufficient privilege to reach the provisioner daemon serve endpoint (for example, a compromised provisioner service account, a malicious insider, or an attacker who has moved laterally within the deployment's internal network) crafts a small DataUpload protocol message declaring a FileSize of roughly 1 TiB. The provisioner daemon's NewDataBuilder attempts to allocate a byte slice of that declared size without validating it against any upper bound. Go's runtime cannot satisfy the allocation and aborts the process, crashing coderd and taking down workspace provisioning for the entire deployment — including any AI agent or ML dev environments hosted on that Coder instance — until an operator manually restarts the service.

Weaknesses (CWE)

CWE-789 Memory Allocation with Excessive Size Value Primary CWE-789 Memory Allocation with Excessive Size Value

CWE-789 — Memory Allocation with Excessive Size Value: The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

[Implementation, Architecture and Design] Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
[Operation] Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

Source: MITRE CWE corpus.