CVE-2026-65654
Received Received - Intake

Label Map Limit Bypass in Ringpop-go

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Temporal Technologies Inc.

Description
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potentially making the hosting process unavailable. The fix validates peer-supplied label maps before they are retained or disseminated. Availability only; no confidentiality or integrity impact was identified.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-65654
EUVD
EUVD-2026-83895

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
temporalio ringpop-go *
temporalio ringpop-go to 0.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ringpop-go allows a network peer to exploit label limits by sending excessive label keys, values, or counts that exceed configured bounds. The system enforces limits only for local label changes but fails to validate incoming labels from peers during SWIM membership updates. This leads to unbounded memory and gossip-bandwidth consumption, potentially causing the hosting process to become unavailable.

Detection Guidance

Monitor network traffic for excessive label updates or membership changes. Check for processes consuming high memory or CPU due to unbounded label storage. Inspect logs for SWIM protocol errors or rejected label sets.

Impact Analysis

An attacker could repeatedly send malicious label updates to a Ringpop TChannel listener, causing the system to consume excessive memory and network bandwidth. This may lead to degraded performance, crashes, or denial of service for the affected application or cluster.

Compliance Impact

This vulnerability primarily impacts system availability by allowing memory and network bandwidth exhaustion through excessive label submissions. While it does not directly affect confidentiality or integrity, availability issues could indirectly impact compliance with standards like GDPR or HIPAA by disrupting access to personal or health data systems.

Mitigation Strategies
  • Upgrade to a patched version of ringpop-go that enforces label limits on incoming membership changes.
  • Configure MaxMembers and LabelOptions limits to prevent unbounded label storage and member tracking.
  • Restrict network access to TChannel listeners to trusted peers only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart