CVE-2026-65652
Received Received - Intake

TChannel-Go Call Frame Checksum Validation Flaw Enables DoS

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Temporal Technologies Inc.

Description
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-65652
EUVD
EUVD-2026-83893

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
temporalio tchannel-go *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a lack of validation in the one-byte checksum-type field in TChannel call frames. A remote attacker can send a crafted request with an unsupported checksum type, causing a Go panic in the connection read goroutine and terminating the hosting process. This leads to a denial of service for applications exposing the listener to untrusted peers.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in applications using tchannel-go or checking for unsupported checksum types in network traffic. Inspect logs for Go panics related to checksum handling or TChannel protocol errors. Use network monitoring tools like tcpdump or Wireshark to analyze TChannel frames for invalid checksum-type values.

Impact Analysis

The impact is limited to availability; no confidentiality or integrity issues were identified. If you run an application using github.com/temporalio/tchannel-go and expose it to untrusted networks, an attacker could crash your service by sending a malformed request, causing downtime.

Compliance Impact

This vulnerability primarily impacts availability by causing remote denial of service through application crashes. It does not directly affect confidentiality or integrity of data. Compliance with standards like GDPR or HIPAA is indirectly impacted only if service unavailability leads to disruptions in processing personal or health data within required timeframes.

Mitigation Strategies

Update tchannel-go to the latest patched version that validates checksum types. If updating is not immediately possible, restrict network access to TChannel listeners using firewalls or network segmentation to prevent untrusted peers from reaching the vulnerable endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart