Coder's file-archives to tar in memory. The conversion enforced a per-file size limit but omitted any aggregate size limit. This upload a zip file containing many large entries, exhausting the process's in-memory resources and causing the service to crash or become unresponsive. The result is a denial of service that affects only the availability of the Coder instance. The weakness is a classic example of insufficient resource limits (CWE-770) combined with miscalculated size handling (CWE-409).

The vulnerability affects Coder releases that implement the buggy upload logic: versions 2.17.0 through 2.29.6, 2.32.6, 2.33.7, and 2.34.1. All other releases, including 2.29.7, 2.32.7, 2.33.8, later, contain fixes that enforce an aggregate size limit during decompression.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% suggests a very low exploitation probability, and the vulnerability is not listed in CISA's KEV catalog, implying limited exploitation activity. Exploitation requires authenticated access to the file-upload endpoint; the attack is, any user granted that permission could trigger the denial of service, but the risk to external attackers is low. Overall, the threat is operational rather than strategic, and immediate patching mitigates the risk.