TI-2024-02504 Aliases CVE-2024-2689 GHSA-wmxc-v39r-p9wf

Denial of Service if invalid UTF-8 sent

LOW 21CWE-20Published 2024-04-03 · Updated 2025-08-27

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00487 42nd percentileScored 2026-11-07

Fix Fixed Temporal Server (Temporal Technologies, Inc.): 1.20.5, 1.21.6, 1.22.7github.com/temporalio/temporal (Go): 1.22.7, 1.21.6, 1.20.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Temporal Technologies, Inc.	Temporal Server	before 1.20.5; 1.21.0 to before 1.21.6; 1.22.0 to before 1.22.7	1.20.5, 1.21.6, 1.22.7	Patch available	CNA
—	github.com/temporalio/temporal (Go)	1.22.0-rc1 to before 1.22.7	1.22.7	Patch available	GHSA-wmxc-v39r-p9wf
—	github.com/temporalio/temporal (Go)	1.21.0 to before 1.21.6	1.21.6	Patch available	GHSA-wmxc-v39r-p9wf
—	github.com/temporalio/temporal (Go)	before 1.20.5	1.20.5	Patch available	GHSA-wmxc-v39r-p9wf

Temporal Server VendorTemporal Technologies, Inc. Affected before 1.20.5; 1.21.0 to before 1.21.6; 1.22.0 to before 1.22.7 Fixed in 1.20.5, 1.21.6, 1.22.7 Patch available CNA
github.com/temporalio/temporal (Go) Vendor— Affected 1.22.0-rc1 to before 1.22.7 Fixed in 1.22.7 Patch available GHSA-wmxc-v39r-p9wf
github.com/temporalio/temporal (Go) Vendor— Affected 1.21.0 to before 1.21.6 Fixed in 1.21.6 Patch available GHSA-wmxc-v39r-p9wf
github.com/temporalio/temporal (Go) Vendor— Affected before 1.20.5 Fixed in 1.20.5 Patch available GHSA-wmxc-v39r-p9wf

Remediation

Fix · CNA Temporal Server (Temporal Technologies, Inc.) Fixed in 1.20.5, 1.21.6, 1.22.7
Fix · GHSA-wmxc-v39r-p9wf github.com/temporalio/temporal (Go) Fixed in 1.22.7 Advisory →
Fix · GHSA-wmxc-v39r-p9wf github.com/temporalio/temporal (Go) Fixed in 1.21.6 Advisory →
Fix · GHSA-wmxc-v39r-p9wf github.com/temporalio/temporal (Go) Fixed in 1.20.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-2689
2026-10-03 Alias added: GHSA-wmxc-v39r-p9wf

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-2689

Other 5

TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
TI-2026-46800 temporalio/tchannel-go zero-chunk call fragment causes process termination CVSS 4.0HIGH 8.7
TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences