Denial of Service Vulnerability in TChannel for Go by Temporal.io
CVE-2026-65653

8.7HIGH

Key Information:

Vendor

Temporal Technologies, Inc.

Status
Temporalio/tchannel-go
Vendor
CVE Published:
21 September 2026

What is CVE-2026-65653?

The TChannel for Go product from Temporal.io is susceptible to a denial of service vulnerability due to improper handling of TChannel call fragments. Specifically, the system fails to reject fragments containing checksum metadata without accompanying length-prefixed argument chunks, causing a panic in the Go slice-bounds. When a network peer sends a malformed call fragment post-initialization handshake, it results in a slice-bounds panic, leading to a termination of the hosting process. This vulnerability primarily affects the availability of applications that rely on untrusted peer connections, posing significant risks to services exposed to these conditions.

Affected Version(s)

temporalio/tchannel-go 0.0.0-20150531204735-8d8ca17342b3 < 1.22.1-0.20260720194454-0cb017f6870a

References

https://github.com/temporalio/tchannel-go/commit/8d8ca173...
product
https://github.com/temporalio/tchannel-go/blob/8706a1ab5f...
product
https://github.com/temporalio/tchannel-go/commit/1dcfa672...
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

An external security researcher who reported this issue responsibly to Temporal Technologies
.