14 matches found
CVE-2026-65654
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...
CVE-2026-65653
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...
CVE-2026-65652
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...
CVE-2026-65654
CVE-2026-65654 affects github.com/temporalio/ringpop-go , a Go library implementing the SWIM membership protocol used by Temporal. The vulnerability is a missing enforcement of configured LabelOptions limits on inbound gossip: while local label changes are validated, label maps received from peer...
EUVD-2026-83895
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...
CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...
EUVD-2026-83894
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...
CVE-2026-65653
github.com/temporalio/tchannel-go failed to reject TChannel call fragments that carry checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element, producing an unrecovered Go slice-bounds panic on a l...
CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...
EUVD-2026-83893
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...
CVE-2026-65652 temporalio/tchannel-go malformed checksum type causes process termination
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...
CVE-2026-65652
github.com/temporalio/tchannel-go fails to validate the one-byte checksum-type field in inbound TChannel call frames. An unauthenticated remote peer that completes the standard initialization handshake can send a call request with an unsupported checksum type. The parser uses that value as an ind...
