CVE-2026-65653
Received Received - Intake

TChannel Fragment Parsing Denial of Service in Temporal Go SDK

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Temporal Technologies Inc.

Description
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-65653
EUVD
EUVD-2026-83894

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
temporalio tchannel-go *
temporalio tchannel-go 1.22.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the TChannel-Go library where malformed call fragments containing checksum metadata but no length-prefixed argument chunks are not properly rejected. The fragment reader leaves its chunk slice empty and then incorrectly selects the first element, causing a Go slice-bounds panic that terminates the hosting process. This leads to remote denial of service against applications exposing the listener to untrusted peers.

Detection Guidance

This vulnerability can be detected by monitoring for crashes or panics in applications using tchannel-go library versions prior to the patched commits. Check logs for Go runtime panics related to slice bounds or fragment handling. Ensure your application uses the latest version of tchannel-go with the fragmenting reader/writer fixes.

Impact Analysis

The impact is limited to availability; no confidentiality or integrity impact was identified. A remote attacker can exploit this to crash the application by sending a malformed call fragment, causing a denial of service.

Compliance Impact

This vulnerability primarily impacts availability by causing denial of service through process termination. It does not directly affect confidentiality or integrity of data. Compliance with standards like GDPR or HIPAA is indirectly affected only if the denial of service disrupts systems handling personal or health data, potentially impacting availability requirements. No direct impact on data protection measures is identified.

Mitigation Strategies

Update the tchannel-go library to the latest patched version that includes the fragmenting reader/writer changes and checksum validation fixes. Review and apply the commits that address malformed call frame handling to prevent crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart