Vulnerability · Published Sep 21, 2026 · Assigned by Temporal
CVE-2026-65653temporalio/tchannel-go zero-chunk call fragment causes process termination
High 8.7
In plain English
A high-severity security flaw in temporalio/tchannel-go from Temporal Technologies, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Temporal Technologies, Inc. | temporalio/tchannel-go | 0.0.0-20150531204735-8d8ca17342b3 – before 1.22.1-0.20260720194454-0cb017f6870a |
Weakness: CWE-129 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N