CVE-2026-65654 in ringpop-go
Summary
by MITRE • 09/21/2026
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potentially making the hosting process unavailable. The fix validates peer-supplied label maps before they are retained or disseminated. Availability only; no confidentiality or integrity impact was identified.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability in temporalio/ringpop-go represents a critical inconsistency in input validation logic within the distributed membership protocol implementation. Ringpop is designed to manage service discovery and node coordination using the SWIM (Scalable Weakly-consistent Infection-style Process Monitor) protocol, which relies on gossip-based communication to propagate state changes across cluster members. The core technical flaw lies in a discrepancy between how local configuration constraints are enforced versus how external inputs are processed. Specifically, while the application correctly enforces configured LabelOptions limits when an application modifies its own node labels, these same validation checks are entirely bypassed for label maps received from remote peers during SWIM membership updates. This asymmetry creates a significant security gap where internal policy enforcement does not extend to data originating from network sources, violating the principle of consistent input validation across all trust boundaries within the protocol handler.
From an operational perspective, this flaw allows any network peer with access to the live Ringpop TChannel listener to execute a denial-of-service attack against the target process. An attacker can repeatedly submit membership change messages containing label keys, values, or counts that exceed the receiver's configured limits. Because these maliciously crafted labels are accepted and retained in the member list without validation, they consume memory resources proportional to their size and complexity. Furthermore, since Ringpop disseminates this state to other peers via gossip protocols, the invalid data propagates throughout the cluster, leading to a cascading effect where bandwidth consumption also exceeds configured bounds. This uncontrolled resource exhaustion can eventually render the hosting process unavailable by depleting system memory or saturating network interfaces, effectively disrupting service availability for dependent applications relying on accurate node discovery and health status.
The security impact of this vulnerability is strictly limited to availability, with no identified implications for confidentiality or integrity. The attacker cannot read sensitive data from other nodes nor can they modify the logic or execution flow of the application beyond causing resource exhaustion. However, in distributed systems where service continuity is paramount, even a pure denial-of-service condition poses severe risks to business operations and system reliability. The persistence of invalid labels in the member list further exacerbates the issue by ensuring that the memory leak continues as long as the node remains part of the cluster or until manual intervention clears the state.
To mitigate this vulnerability, it is imperative to apply the provided fix which validates peer-supplied label maps before they are retained in local data structures or disseminated to other peers. This ensures that all inputs, regardless of their origin, adhere to the same security policies and configuration limits defined by the administrator. Organizations should update temporalio/ringpop-go to a patched version immediately if they utilize this library for service discovery. Additionally, implementing network-level rate limiting on TChannel connections can provide an additional layer of defense against rapid-fire membership updates from untrusted sources. Monitoring memory usage patterns associated with member list growth may also help in detecting such attacks early before critical thresholds are reached. This issue aligns with CWE-20 Improper Input Validation and is relevant to ATT&CK technique T1498 Network Denial of Service, highlighting the importance of rigorous validation for all external inputs in distributed systems.