CVE-2026-55434: Anthropic Python AI Bridge

Q: Is CVE-2026-55434 actively exploited?

No confirmed active exploitation of CVE-2026-55434 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55434?

Upgrade to Coder v2.34.2 (2.34 line) or v2.33.8 (2.33 line), both of which apply http.MaxBytesReader or an equivalent cap before AI Bridge provider/session bodies are read. There is no workaround, so until patched, consider disabling the AI Bridge feature entirely on affected instances or placing a reverse proxy/WAF in front of coderd that enforces a strict request body size limit on /api/v2/aibridge/* paths as a stopgap. For detection, monitor coderd process memory usage for sudden unbounded growth correlated with requests to AI Bridge provider endpoints, and review access logs for anomalously large or chunked-transfer-encoded POST bodies from member-level accounts hitting those routes; also audit which users hold AI Bridge access, since exploitation requires an authenticated account.

Q: What systems are affected by CVE-2026-55434?

This vulnerability affects the following AI/ML architecture patterns: LLM API gateways/proxies, AI-enabled developer environments, agent frameworks.

Q: What is the CVSS score for CVE-2026-55434?

CVE-2026-55434 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.55%.

CISO Take

Coder's AI Bridge feature reads incoming request bodies with io.ReadAll and no size cap, so any authenticated member-level user can POST an oversized or chunked payload to a provider endpoint like /api/v2/aibridge/anthropic/v1/messages and force unbounded heap growth until the OS kills the process. Because AI Bridge runs in-process with coderd, this isn't a contained feature outage — it takes down the entire control plane, including the API, workspace coordinator, and DERP relay, for every user on the deployment. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template, and Anthropic's own security team responsibly disclosed it rather than it surfacing from active abuse, so near-term exploitation likelihood is low; the requirement for an authenticated account and the AI Bridge feature being enabled further narrows exposure to 2.33/2.34 deployments that have opted into it. Patch to v2.34.2 (or v2.33.8 on the 2.33 line) immediately if AI Bridge is enabled — there is no workaround — and in the interim consider disabling AI Bridge or fronting it with a reverse proxy that enforces a request body size limit.

Sources: NVD GitHub Advisory CISA KEV EPSS ATLAS

What is the risk?

CVSS 6.5 (medium), AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H — network-exploitable with low complexity but requiring low-privilege authentication, no user interaction, and impact confined purely to availability (no confidentiality or integrity loss). Real-world risk is dampened by three factors: exploitation needs a valid authenticated account with AI Bridge access (not an anonymous attacker), the AI Bridge feature itself must be enabled (opt-in, limited to the 2.33/2.34 release lines), and there is no evidence of a public PoC, scanner template, EPSS scoring, or KEV listing. However, the blast radius within an affected deployment is severe: a single crafted request from any low-privileged member crashes the shared control plane for the whole organization, not just the AI feature, making this a high-impact-but-low-likelihood DoS suited to insider-threat and compromised-account scenarios rather than opportunistic internet-wide scanning.

How does the attack unfold?

Initial Access

Attacker authenticates as a low-privilege member with AI Bridge access on the target Coder deployment.

AML.T0012

Exploitation

Attacker sends a large or chunked-transfer POST body to an AI Bridge provider endpoint (e.g., /api/v2/aibridge/anthropic/v1/messages), which coderd reads fully via io.ReadAll with no size limit.

AML.T0034.001

Resource Exhaustion

Heap memory grows unbounded as the body is buffered, and the operating system's OOM killer terminates the coderd process.

Impact

The shared control plane (API, workspace coordinator, DERP relay) crashes organization-wide, denying all users access to workspaces until the service is restarted.

AML.T0029

Initial Access

Attacker authenticates as a low-privilege member with AI Bridge access on the target Coder deployment.

AML.T0012

Exploitation

Attacker sends a large or chunked-transfer POST body to an AI Bridge provider endpoint (e.g., /api/v2/aibridge/anthropic/v1/messages), which coderd reads fully via io.ReadAll with no size limit.

AML.T0034.001

Resource Exhaustion

Heap memory grows unbounded as the body is buffered, and the operating system's OOM killer terminates the coderd process.

Impact

The shared control plane (API, workspace coordinator, DERP relay) crashes organization-wide, denying all users access to workspaces until the service is restarted.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed 3d ago 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Upgrade to Coder v2.34.2 (2.34 line) or v2.33.8 (2.33 line), both of which apply http.MaxBytesReader or an equivalent cap before AI Bridge provider/session bodies are read. There is no workaround, so until patched, consider disabling the AI Bridge feature entirely on affected instances or placing a reverse proxy/WAF in front of coderd that enforces a strict request body size limit on /api/v2/aibridge/* paths as a stopgap. For detection, monitor coderd process memory usage for sudden unbounded growth correlated with requests to AI Bridge provider endpoints, and review access logs for anomalously large or chunked-transfer-encoded POST bodies from member-level accounts hitting those routes; also audit which users hold AI Bridge access, since exploitation requires an authenticated account.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS API AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - Resource documentation and management for AI systems

NIST AI RMF

MANAGE 4.1 - AI system availability and resilience risk management

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-55434?

Coder's AI Bridge feature reads incoming request bodies with io.ReadAll and no size cap, so any authenticated member-level user can POST an oversized or chunked payload to a provider endpoint like /api/v2/aibridge/anthropic/v1/messages and force unbounded heap growth until the OS kills the process. Because AI Bridge runs in-process with coderd, this isn't a contained feature outage — it takes down the entire control plane, including the API, workspace coordinator, and DERP relay, for every user on the deployment. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template, and Anthropic's own security team responsibly disclosed it rather than it surfacing from active abuse, so near-term exploitation likelihood is low; the requirement for an authenticated account and the AI Bridge feature being enabled further narrows exposure to 2.33/2.34 deployments that have opted into it. Patch to v2.34.2 (or v2.33.8 on the 2.33 line) immediately if AI Bridge is enabled — there is no workaround — and in the interim consider disabling AI Bridge or fronting it with a reverse proxy that enforces a request body size limit.

Is CVE-2026-55434 actively exploited?

No confirmed active exploitation of CVE-2026-55434 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55434?

Upgrade to Coder v2.34.2 (2.34 line) or v2.33.8 (2.33 line), both of which apply http.MaxBytesReader or an equivalent cap before AI Bridge provider/session bodies are read. There is no workaround, so until patched, consider disabling the AI Bridge feature entirely on affected instances or placing a reverse proxy/WAF in front of coderd that enforces a strict request body size limit on /api/v2/aibridge/* paths as a stopgap. For detection, monitor coderd process memory usage for sudden unbounded growth correlated with requests to AI Bridge provider endpoints, and review access logs for anomalously large or chunked-transfer-encoded POST bodies from member-level accounts hitting those routes; also audit which users hold AI Bridge access, since exploitation requires an authenticated account.

What systems are affected by CVE-2026-55434?

This vulnerability affects the following AI/ML architecture patterns: LLM API gateways/proxies, AI-enabled developer environments, agent frameworks.

What is the CVSS score for CVE-2026-55434?

CVE-2026-55434 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

LLM API gateways/proxiesAI-enabled developer environmentsagent frameworks

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

### Summary AI Bridge provider handlers read request bodies with `io.ReadAll` without a maximum size so an authenticated user with AI Bridge access could send an arbitrarily large body and exhaust memory. > **Note:** Exploitation requires authenticated access to the AI Bridge endpoints and the impact is limited to availability (denial of service). ### Impact An authenticated member-level user could POST a very large or chunked body to an AI Bridge provider endpoint such as `/api/v2/aibridge/anthropic/v1/messages`, growing heap memory until the operating system terminates the process. Because AI Bridge runs in-process with `coderd`, this crashes the entire control plane, including the API, workspace coordinator and DERP relay. It requires an authenticated user and the AI Bridge feature enabled. ### Patches The fix applies `http.MaxBytesReader` or an equivalent cap before reading provider and session request bodies. The affected AI Bridge provider endpoints exist only on the v2.33 and v2.34 lines. Earlier release lines are not affected. The fix is available in the following releases: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | ### Workarounds None. ### Resources - Fix: #26164 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22443) for independently disclosing this issue!

Exploitation Scenario

A disgruntled or compromised low-privilege developer account with AI Bridge access crafts an HTTP POST to /api/v2/aibridge/anthropic/v1/messages using a chunked transfer-encoding body that streams gigabytes of arbitrary data with no Content-Length cap. coderd's handler calls io.ReadAll on the body without a size limit, buffering the entire payload into memory; repeating or parallelizing the request rapidly exhausts available heap, and the OS OOM-killer terminates the coderd process. Because AI Bridge runs in-process with the rest of the control plane, this single request family takes down the API, workspace coordinator, and DERP relay simultaneously, causing an organization-wide outage until the service is restarted — no data is exposed or altered, but every developer loses access to their workspaces.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.