CVE-2026-65652

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

CVSS

No CVSS.

References

Link	Resource
https://github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc1881df0/checksum.go#L29-L93
https://github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc1881df0/reqres.go#L280-L295
https://github.com/temporalio/tchannel-go/commit/0cb017f6870a8420695abeb9a4560d39dadc4e2e
https://github.com/temporalio/tchannel-go/commit/a6904155f628b9e602b7bc88ef489004a786f7f4
https://github.com/temporalio/tchannel-go/pull/14
https://github.com/temporalio/tchannel-go/tree/v1.22.1

Configurations

No configuration.

History

21 Sep 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 12:17

Updated : 2026-09-22 19:40

NVD link : CVE-2026-65652

Mitre link : CVE-2026-65652

CVE.ORG link : CVE-2026-65652

JSON object : View

Products Affected

No product.

CWE

CWE-129

Improper Validation of Array Index

{"id": "CVE-2026-65652", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65652", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T15:29:36.927700Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@temporal.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@temporal.io", "affectedData": [{"repo": "https://github.com/temporalio/tchannel-go", "vendor": "Temporal Technologies, Inc.", "modules": ["Checksum", "Frame parser"], "product": "temporalio/tchannel-go", "versions": [{"status": "affected", "version": "0.0.0-20160105034737-a6904155f628", "lessThan": "1.22.1-0.20260720194454-0cb017f6870a", "versionType": "semver"}], "packageName": "github.com/temporalio/tchannel-go", "programFiles": ["checksum.go", "reqres.go", "inbound.go"], "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected"}]}], "published": "2026-09-21T12:17:15.800", "references": [{"url": "https://github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc1881df0/checksum.go#L29-L93", "source": "security@temporal.io"}, {"url": "https://github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc1881df0/reqres.go#L280-L295", "source": "security@temporal.io"}, {"url": "https://github.com/temporalio/tchannel-go/commit/0cb017f6870a8420695abeb9a4560d39dadc4e2e", "source": "security@temporal.io"}, {"url": "https://github.com/temporalio/tchannel-go/commit/a6904155f628b9e602b7bc88ef489004a786f7f4", "source": "security@temporal.io"}, {"url": "https://github.com/temporalio/tchannel-go/pull/14", "source": "security@temporal.io"}, {"url": "https://github.com/temporalio/tchannel-go/tree/v1.22.1", "source": "security@temporal.io"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@temporal.io", "description": [{"lang": "en", "value": "CWE-129"}]}], "descriptions": [{"lang": "en", "value": "github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified."}], "lastModified": "2026-09-22T19:40:05.870", "sourceIdentifier": "security@temporal.io"}