Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-16652

Temporal Server Schedule exclusion search can cause excessive CPU consumption

CVSS 4.0 7.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-16652

Published

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-16652

Published

go.temporal.io/server

https://pkg.go.dev

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "Temporal Server",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "go.temporal.io/server",
                    "repo": "https://github.com/temporalio/temporal",
                    "modules": [
                        "Schedules"
                    ],
                    "programFiles": [
                        "service/worker/scheduler/spec.go"
                    ],
                    "programRoutines": [
                        {
                            "name": "CompiledSpec.GetNextTime"
                        }
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.17.0",
                            "lessThanOrEqual": "1.29.7",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.30.0",
                            "lessThan": "1.30.7",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.31.0",
                            "lessThan": "1.31.3",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON