Denial Of Service (DoS)

Temporal Server is vulnerable to Denial of Service DoS. The vulnerability is caused by an authenticated user with permissions to interact with workflows submitting an invalid UTF-8 string which causes an application crash. This can lead to stuck tasks in the queue, increased queue lag, resource...

GHSA-WMXC-V39R-P9WF Temporal Server Denial of Service

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

Temporal Server Denial of Service

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

CVE-2024-2689

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

CVE-2024-2689 Denial of Service if invalid UTF-8 sent

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

CVE-2024-2689 Denial of Service if invalid UTF-8 sent

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

CVE-2024-2689 Denial of Service if invalid UTF-8 sent

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

CVE-2024-2689

Summary: CVE-2024-2689 is a Temporal Server DoS affecting versions 1.20.5, 1.21.6 and 1.22.7 where an authenticated user with workflow permissions can submit an invalid UTF-8 string to trigger a crashloop, causing queue lag and eventual resource exhaustion. The logs may reveal the failing workflo...

CVE-2024-2689

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

PT-2024-21562

Name of the Vulnerable Software and Affected Versions Temporal Server versions prior to 1.20.5 Temporal Server versions prior to 1.21.6 Temporal Server versions prior to 1.22.7 Description The issue allows an authenticated user with permissions to interact with workflows to potentially cause a...

Temporal Server security vulnerabilities

Temporal Server is a microservices orchestration platform from Temporal. A security vulnerability exists in Temporal Server versions prior to 1.20.5, 1.21.6, and 1.22.7, which stems from a vulnerability that allows an attacker to interact with a workflow and craft invalid UTF-8 strings for...

CVE-2024-2689: Improper Input Validation

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: step-ca, kine, spicedb, src, trillian, temporal-server, falcosidekick-fips, argo-workflows, k3s, caddy, temporal-server-fips, trillian-fips, kube-bench, kube-bench-fips, caddy-fips, argo-workflows-fips, step, kots, wavefront-collector-for-kubernetes, amass, ferretdb...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: step-ca, kine, argo-workflows, spicedb, src, step, k3s, kots, kube-bench, trillian, amass, temporal-server, caddy, ferretdb...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: cass-operator, k8ssandra-operator, runc, crossplane-provider-azure-sql, helm, grpcurl, argo-workflows, etcd, caddy, hubble-fips, cri-tools, aactl, prometheus-stackdriver-exporter, secrets-store-csi-driver-provider-aws, prometheus-node-exporter, hugo-extended,...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step-ca, kine, spicedb, src, trillian, temporal-server, falcosidekick-fips, argo-workflows, k3s, caddy, temporal-server-fips, trillian-fips, kube-bench, kube-bench-fips, caddy-fips, argo-workflows-fips, step, kots, wavefront-collector-for-kubernetes, amass, ferretdb...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step-ca, kine, argo-workflows, spicedb, src, step, k3s, kots, kube-bench, trillian, amass, temporal-server, caddy, ferretdb...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: step-ca, kine, spicedb, src, trillian, temporal-server, falcosidekick-fips, argo-workflows, k3s, caddy, temporal-server-fips, trillian-fips, kube-bench, kube-bench-fips, caddy-fips, argo-workflows-fips, step, kots, wavefront-collector-for-kubernetes, amass, ferretdb...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: kubevela, temporal, kine, volume-modifier-for-k8s, kubernetes, kubernetes-csi-external-resizer, k3s, buildkitd, envoy-ratelimit, docker-compose, kubescape, metrics-server, temporal-server, cri-tools...

GHSA-GM2G-2XR9-PXXJ Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...