Vulnerability · Published Sep 15, 2025 · Assigned by Temporal
CVE-2025-8396
Medium 6.9
In plain English
A medium-severity resource allocation without limits in OSS Server from Temporal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | go.temporal.io/server | 1.26.3 | GHSA-p768-c3pr-6459 |
| Go | go.temporal.io/server | 1.27.3 | GHSA-p768-c3pr-6459 |
| Go | go.temporal.io/server | 1.28.1 | GHSA-p768-c3pr-6459 |
| Go | go.temporal.io/server | 1.26.3, 1.27.3, 1.28.1 | GO-2025-3953 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Temporal | OSS Server | 0 – before 1.26.31.27.0 – before 1.27.31.28.0 – before 1.28.1 |
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y