Temporal tchannel-go prior 1.22.1-0.20260720194454-0cb017f6870a Fragment Reader memory corruption

Summaryinfo

A vulnerability was found in Temporal tchannel-go. It has been declared as problematic. This vulnerability affects unknown code of the component Fragment Reader. Such manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2026-65653. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Temporal tchannel-go and classified as problematic. Affected by this issue is some unknown processing of the component Fragment Reader. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. CVE summarizes:

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-65653 since 07/22/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.22.1-0.20260720194454-0cb017f6870a eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Temporal

Name

• tchannel-go

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion