Read the docs
TI-2026-46800 Aliases CVE-2026-65653GHSA-vg3p-fxfm-m684

temporalio/tchannel-go zero-chunk call fragment causes process termination

Priority MEDIUM 45CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0071 53rd percentileScored 2026-11-07
Fix Partial temporalio/tchannel-go (Temporal Technologies, Inc.): 1.22.1-0.20260720194454-0cb017f6870aRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Temporal Technologies, Inc.temporalio/tchannel-go0.0.0-20150531204735-8d8ca17342b3 to before 1.22.1-0.20260720194454-0cb017f6870a1.22.1-0.20260720194454-0cb017f6870aPatch availableCNA
  • temporalio/tchannel-go VendorTemporal Technologies, Inc. Affected 0.0.0-20150531204735-8d8ca17342b3 to before 1.22.1-0.20260720194454-0cb017f6870a Fixed in 1.22.1-0.20260720194454-0cb017f6870a Patch available CNA

Remediation

  • Fix · CNA temporalio/tchannel-go (Temporal Technologies, Inc.) Fixed in 1.22.1-0.20260720194454-0cb017f6870a

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Temporal Technologies temporalio/tchannel-go 1.22.1-0.20260720194454-0cb017f6870a

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process terminationPriority MEDIUM 45
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65653
  2. 2026-10-03 Alias added: GHSA-vg3p-fxfm-m684
  3. 2026-10-23 Affected versions changed · Red Hat
  4. 2026-10-23 CVSS score added · Red Hat

References

Patch 2

Other 4

  • TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
  • TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
  • TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
  • TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
  • TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7
  • TI-2026-60383 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host CVSS 4.0HIGH 8.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences