Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-65653

temporalio/tchannel-go zero-chunk call fragment causes process termination

CVSS 4.0 8.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-65653

Published

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-65653

Published

github.com/temporalio/tchannel-go

https://pkg.go.dev

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "temporalio/tchannel-go",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "github.com/temporalio/tchannel-go",
                    "repo": "https://github.com/temporalio/tchannel-go",
                    "modules": [
                        "Fragmentation",
                        "Frame parser"
                    ],
                    "programFiles": [
                        "fragmenting_reader.go",
                        "inbound.go",
                        "outbound.go"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.0.0-20150531204735-8d8ca17342b3",
                            "lessThan": "1.22.1-0.20260720194454-0cb017f6870a",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON