CVE-2026-65653: temporalio/tchannel-go zero-chunk call fragment causes process termination
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
github.com/temporalio/tchannel-goto a version that resolves this vulnerability.Fixed in v1.22.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using temporalio/tchannel-go are exposed if their TChannel listener accepts connections from untrusted network peers. The issue affects the inbound call-handling path and can terminate the hosting process.
What must an attacker do to trigger the denial of service?
An attacker must connect as a network peer, complete the standard TChannel initialization handshake, and send a malformed call fragment that includes checksum metadata but contains no length-prefixed argument chunks. This can be sent as the initial call request.
Is authentication or a valid application request required?
The available information only requires a network peer to complete the standard initialization handshake and provide the malformed fragment. It does not state that application-level authentication or a valid call is required.
What happens when exploitation succeeds?
The malformed fragment causes an unrecovered slice-bounds panic in a library-created dispatch goroutine. The panic terminates the hosting process, affecting availability only; no confidentiality or integrity impact was identified.