CVE-2026-65653
HighCVSS 8.7Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake, causing an unrecovered Go slice-bounds panic on a library-created dispatch goroutine and terminating the hosting process.
Risk Assessment
An attacker can remotely cause denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.
Recommendation
Upgrade github.com/temporalio/tchannel-go to a version containing the fix that rejects malformed call fragments. Until upgraded, consider restricting network access to the TChannel listener.
Other vulnerabilities in tchannel-go
Original NVD description (English source)
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS