232 matches found
CLEANSTART-2026-DX00522 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources
Security vulnerability affects the temporal-server package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...
CLEANSTART-2026-FA40007 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the temporal-server package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-ST40706 url
Security vulnerability affects the temporal-server package. url...
CLEANSTART-2026-KS11045 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations
Security vulnerability affects the temporal-server package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...
CLEANSTART-2026-OD21402 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
Security vulnerability affects the temporal-server package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...
CLEANSTART-2026-HI32575 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...
Security vulnerability affects the temporal-server package. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the...
CLEANSTART-2026-CN39298 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions
Security vulnerability affects the temporal-server package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions...
CLEANSTART-2026-GL68033 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)
Security vulnerability affects the temporal-server package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...
CLEANSTART-2026-KT14793 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
Security vulnerability affects the temporal-server package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...
CLEANSTART-2026-IC49054 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
Security vulnerability affects the temporal-server package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CLEANSTART-2026-YE75739 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the temporal-server package. Previously, resolving relative paths containing parent directory '...
CVE-2026-89139
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-87858
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
CVE-2026-16652
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...
CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-89139
Temporal Server versions 1.31.0 through
EUVD-2026-83897
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...