temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip
Summary
| CVE | CVE-2026-65654 |
|---|---|
| State | PUBLISHED |
| Assigner | Temporal |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-21 12:17:16 UTC |
| Updated | 2026-09-22 19:40:05 UTC |
| Description | github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potentially making the hosting process unavailable. The fix validates peer-supplied label maps before they are retained or disseminated. Availability only; no confidentiality or integrity impact was identified. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.005520000 probability, percentile 0.450240000 (date 2026-09-23)
Problem Types: CWE-770 | CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Temporal Technologies Inc. | Temporalio/ringpop-go | affected 0.0.0-20160824133849-d0de5fe13330 0.0.0-20260724173031-c317effcdc8b semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/temporalio/ringpop-go/commit/c317effcdc8bc09ed1c11f00994782bd... | [email protected] | github.com | |
| github.com/temporalio/ringpop-go/tree/v0.1.0 | [email protected] | github.com | |
| github.com/temporalio/ringpop-go/pull/22 | [email protected] | github.com | |
| github.com/temporalio/ringpop-go/blob/b97329e994f792f70427a7533a3e7a9897... | [email protected] | github.com | |
| github.com/temporalio/ringpop-go/blob/b97329e994f792f70427a7533a3e7a9897... | [email protected] | github.com | |
| github.com/temporalio/ringpop-go/commit/d0de5fe1333074d5c41a88e9053592e3... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: An external security researcher who reported this issue responsibly to Temporal Technologies (en)
Additional Advisory Data
Solutions
CNA: Upgrade github.com/temporalio/ringpop-go to v0.1.0 or later. The fix validates peer-supplied label maps against the configured LabelOptions before labels are retained or disseminated. Invalid incoming labels are discarded while the remaining membership change can still be processed.
Workarounds
CNA: Restrict the Ringpop membership listener to trusted cluster members. Where supported by the embedding application, require mutual TLS with verified client certificates. These controls prevent untrusted clients from reaching the vulnerable receive path but do not correct the missing validation for an authenticated or compromised peer.