Availability Vulnerability in Ringpop by Temporal.io
CVE-2026-65654

8.7HIGH

Key Information:

Vendor

Temporal Technologies, Inc.

Status
Temporalio/ringpop-go
Vendor
CVE Published:
21 September 2026

What is CVE-2026-65654?

The vulnerability in Ringpop allows network peers to exploit label management, leading to potential memory exhaustion and disruptions in service availability. Specifically, when changes to a local node's labels are made, the system fails to enforce limits on label maps from SWIM membership updates, which can cause excessive resource consumption. Accepting oversized label maps allows malicious peers to overwhelm the system, impacting its availability. The fix involves validation of peer-supplied label maps before they are added to the local membership, thereby mitigating the risk of overload.

Affected Version(s)

temporalio/ringpop-go 0.0.0-20160824133849-d0de5fe13330 < 0.0.0-20260724173031-c317effcdc8b

References

https://github.com/temporalio/ringpop-go/commit/d0de5fe13...
product
https://github.com/temporalio/ringpop-go/blob/b97329e994f...
product
https://github.com/temporalio/ringpop-go/blob/b97329e994f...
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

An external security researcher who reported this issue responsibly to Temporal Technologies
.