« Volver al listado

CVE-2026-65653

Estado: Pendiente de análisisAlta (8.7)—

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Aplicación expuesta en red sin autenticación (AV:N/PR:N) vulnerable a fragmentos TChannel malformados que causan pánico no recuperable en goroutina, resultando en DoS del proceso.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Temporalio — Tchannel-goAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-65653",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-65653",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-21T15:28:04.791087Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@temporal.io",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@temporal.io",
      "affectedData": [
        {
          "repo": "https://github.com/temporalio/tchannel-go",
          "vendor": "Temporal Technologies, Inc.",
          "modules": [
            "Fragmentation",
            "Frame parser"
          ],
          "product": "temporalio/tchannel-go",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0-20150531204735-8d8ca17342b3",
              "lessThan": "1.22.1-0.20260720194454-0cb017f6870a",
              "versionType": "semver"
            }
          ],
          "packageName": "github.com/temporalio/tchannel-go",
          "programFiles": [
            "fragmenting_reader.go",
            "inbound.go",
            "outbound.go"
          ],
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-21T12:17:15.973",
  "references": [
    {
      "url": "https://github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc1881df0/fragmenting_reader.go#L256-L308",
      "source": "security@temporal.io"
    },
    {
      "url": "https://github.com/temporalio/tchannel-go/commit/0cb017f6870a8420695abeb9a4560d39dadc4e2e",
      "source": "security@temporal.io"
    },
    {
      "url": "https://github.com/temporalio/tchannel-go/commit/1dcfa67262ecd56a24f12940f4082549190cb5d1",
      "source": "security@temporal.io"
    },
    {
      "url": "https://github.com/temporalio/tchannel-go/commit/8d8ca17342b3620d3a6d5c1a825145595e7588ff",
      "source": "security@temporal.io"
    },
    {
      "url": "https://github.com/temporalio/tchannel-go/pull/14",
      "source": "security@temporal.io"
    },
    {
      "url": "https://github.com/temporalio/tchannel-go/tree/v1.22.1",
      "source": "security@temporal.io"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@temporal.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified."
    }
  ],
  "lastModified": "2026-09-22T19:40:05.870",
  "sourceIdentifier": "security@temporal.io"
}