Coder’s provisioner component creates a byte slice whose size is taken directly from a client‑supplied File. Because the field is not bounded, an attacker who can submit an upload can force the server to allocate an arbitrarily large buffer, bypassing the protocol’s 4 MiB wire limit. The allocation can exhaust memory or trigger a crash, producing a denial of service for the provisioner daemon and any environments that rely on it.

Affected versions include Coder releases from 2.24.0 to 2.29.6, from 2.32.0 to 2.32.6, from 2.33.0 to 2.33.7, and from 2.34.0 to 2.34.1. The issue was resolved in releases 2.29.7, 2.32.7, 2.33.8, and 2.34.2, which enforce a maximum FileSize of 100 MiB before allocating memory.

The CVSS score of 4.9 rates the vulnerability as moderate, but the EPSS score of less than 1% indicates the risk of exploitation is currently low. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permission to upload files through the provisioner daemon serve endpoint. By sending a payload with a large FileSize value, an attacker can provoke an out‑of‑memory condition that kills or stalls the daemon, limiting service availability. The threat is confined to deployments where such uploads are authorized and where the daemon has not been updated to the fixed releases.