CVE-2026-65653

A flaw was found in github.com/temporalio/tchannel-go. A remote attacker can exploit this by sending a specially crafted TChannel call fragment that contains checksum metadata but lacks length-prefixed argument chunks. This can lead to a Go slice-bounds panic, causing the hosting process to...

CVE-2026-65653

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...

CVE-2026-65652

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...

CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...

CVE-2026-65653

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...

CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...

CVE-2026-65653

github.com/temporalio/tchannel-go failed to reject TChannel call fragments that carry checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element, producing an unrecovered Go slice-bounds panic on a l...

EUVD-2026-83894

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...

CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...

CVE-2026-65652 temporalio/tchannel-go malformed checksum type causes process termination

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...

EUVD-2026-83893

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...

CVE-2026-65652 temporalio/tchannel-go malformed checksum type causes process termination

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...

CVE-2026-65652

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...

CVE-2026-65652

github.com/temporalio/tchannel-go fails to validate the one-byte checksum-type field in inbound TChannel call frames. An unauthenticated remote peer that completes the standard initialization handshake can send a call request with an unsupported checksum type. The parser uses that value as an ind...

CVE-2026-65652 temporalio/tchannel-go malformed checksum type causes process termination

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...

PT-2026-96076

Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go affected versions not specified Description The software fails to reject TChannel call fragments that contain checksum metadata but lack length-prefixed argument chunks. In this scenario, the fragment reader...

PT-2026-96075

Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go affected versions not specified Description The software fails to validate the one-byte checksum-type field in inbound TChannel call frames. A remote network peer can complete the standard initialization...

CVE-2026-65652: Improper Validation of Array Index

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as...

CVE-2026-65653: Improper Validation of Array Index

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragmen...