temporalio/tchannel-go zero-chunk call fragment causes process termination
Summary
| CVE | CVE-2026-65653 |
|---|---|
| State | PUBLISHED |
| Assigner | Temporal |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-21 12:17:15 UTC |
| Updated | 2026-09-22 19:40:05 UTC |
| Description | github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.006790000 probability, percentile 0.509480000 (date 2026-09-22)
Problem Types: CWE-129 | CWE-129 CWE-129: Improper Validation of Array Index
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Temporal Technologies Inc. | Temporalio/tchannel-go | affected 0.0.0-20150531204735-8d8ca17342b3 1.22.1-0.20260720194454-0cb017f6870a semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/temporalio/tchannel-go/commit/1dcfa67262ecd56a24f12940f408254... | [email protected] | github.com | |
| github.com/temporalio/tchannel-go/commit/8d8ca17342b3620d3a6d5c1a8251455... | [email protected] | github.com | |
| github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc... | [email protected] | github.com | |
| github.com/temporalio/tchannel-go/tree/v1.22.1 | [email protected] | github.com | |
| github.com/temporalio/tchannel-go/commit/0cb017f6870a8420695abeb9a4560d3... | [email protected] | github.com | |
| github.com/temporalio/tchannel-go/pull/14 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: An external security researcher who reported this issue responsibly to Temporal Technologies (en)
Additional Advisory Data
Solutions
CNA: Upgrade github.com/temporalio/tchannel-go to v1.22.1 or later. The fix rejects fragments containing no argument chunks before indexing the chunk slice.
Workarounds
CNA: Restrict TChannel listener access to trusted peers. Where supported by the embedding application, require mutually authenticated TLS so peers without a trusted client certificate are rejected before TChannel frame parsing. External panic-recovery middleware is not a reliable mitigation because the confirmed inbound panic occurs on a library-created dispatch goroutine.