CVE-2026-126405

The Coder platform versions 2.21.0 before 2.29.24 , 2.30.0 before 2.34.16 , 2.35.0 before 2.36.11 , 2.37.0 before 2.37.8 , and 2.38.0 before 2.38.4 are vulnerable to a Memory Exhaustion Denial of Service (DoS) . The root cause is that the webpushSend function uses io.ReadAll to process Web Push e...

EUVD-2026-125160

Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST...