CVE-2026-65654

CVE-2026-65654 affects github.com/temporalio/ringpop-go , a Go library implementing the SWIM membership protocol used by Temporal. The vulnerability is a missing enforcement of configured LabelOptions limits on inbound gossip: while local label changes are validated, label maps received from peer...

CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...