Resource allocation without limits in Temporal OSS Server
Priority LOW 37CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Fixed OSS Server (Temporal): 1.26.3, 1.27.3, 1.28.1go.temporal.io/server (Go): 1.26.3, 1.27.3, 1.28.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Temporal | OSS Server | before 1.26.3; 1.27.0 to before 1.27.3; 1.28.0 to before 1.28.1 | 1.26.3, 1.27.3, 1.28.1 | Patch available | CNA |
| — | go.temporal.io/server (Go) | before 1.26.3 | 1.26.3 | Patch available | GHSA-p768-c3pr-6459 |
| — | go.temporal.io/server (Go) | 1.27.0-126.0 to before 1.27.3 | 1.27.3 | Patch available | GHSA-p768-c3pr-6459 |
| — | go.temporal.io/server (Go) | 1.28.0-129.0 to before 1.28.1 | 1.28.1 | Patch available | GHSA-p768-c3pr-6459 |
- OSS Server VendorTemporal Affected before 1.26.3; 1.27.0 to before 1.27.3; 1.28.0 to before 1.28.1 Fixed in 1.26.3, 1.27.3, 1.28.1 Patch available CNA
- go.temporal.io/server (Go) Vendor— Affected before 1.26.3 Fixed in 1.26.3 Patch available GHSA-p768-c3pr-6459
- go.temporal.io/server (Go) Vendor— Affected 1.27.0-126.0 to before 1.27.3 Fixed in 1.27.3 Patch available GHSA-p768-c3pr-6459
- go.temporal.io/server (Go) Vendor— Affected 1.28.0-129.0 to before 1.28.1 Fixed in 1.28.1 Patch available GHSA-p768-c3pr-6459
Remediation
- Fix · CNA OSS Server (Temporal) Fixed in 1.26.3, 1.27.3, 1.28.1
- Fix · GHSA-p768-c3pr-6459 go.temporal.io/server (Go) Fixed in 1.26.3 Advisory →
- Fix · GHSA-p768-c3pr-6459 go.temporal.io/server (Go) Fixed in 1.27.3 Advisory →
- Fix · GHSA-p768-c3pr-6459 go.temporal.io/server (Go) Fixed in 1.28.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8396
- 2026-10-03 Alias added: GHSA-p768-c3pr-6459
References
More Temporal vulnerabilities
- TI-2025-13670 Cross Namespace Commands Authorization Bypass CVSS 4.0MEDIUM 5.3
- TI-2023-03253 Insecure Default Authorization in Temporal Server CVSS 3.1LOW 3.6
- TI-2025-13669 ExecuteMultiOperation Namespace Policy Bypass CVSS 4.0LOW 1.3
Sources
- CVE-2025-8396 · CVE Program
- CVE-2025-8396 · NVD
- FIRST EPSS
- GHSA-p768-c3pr-6459 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences