CVE-2026-65652

HighCVSS 8.7

Published: 21/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 21/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

43th percentile - higher than 43% of all known CVEs

Summary

Risk Assessment

An attacker can remotely cause denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

Recommendation

Upgrade github.com/temporalio/tchannel-go to a version containing the fix that validates the checksum-type field. Until upgraded, consider restricting network access to the TChannel listener.

Other vulnerabilities in tchannel-go

CVE-2026-65653High
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake, causing an unrecovered Go slice-bounds panic on a library-created dispatch goroutine and terminating the hosting process.

Original NVD description (English source)

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS