EUVD-2026-83884
GHSA-pv35-7w89-v65c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and low-complexity, but requires namespace-write authentication (PR:L) and impacts availability only, so C:N/I:N/A:H with scope unchanged.
Primary rating from Vendor (Temporal).
CVSS VectorVendor: Temporal
Lifecycle Timeline
4DescriptionCVE.org
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.
AnalysisAI
CPU exhaustion in Temporal Server before v1.30.7 and v1.31.3 allows an authenticated caller holding namespace write permission (PR:L) to persist a Schedule whose fine-grained cadence is fully negated by an exclusion calendar, forcing the next-action-time search to evaluate excluded candidates without any per-search work budget and burning CPU in the Frontend and Schedule worker components. Because the abusive specification is stored, consumption continues through repeated backing-Workflow failures and retries even after the initial request finishes, until the Schedule is deleted or its backing Workflow terminated; repeated or parallel Schedules can degrade or deny service to shared infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated caller holding namespace write permission (PR:L) - not anonymous. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Temporal Server to v1.30.7 or v1.31.3 (or a later release on either line) - vendor-released patches that add the SchedulerSpecMaxIterations/SchedulerSpecWarnIterations compute bounds and the non-retryable ErrScheduleSpecLimitHit behavior described in https://github.com/temporalio/temporal/pull/11014 and https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720, per the v1.30.7 and v1.31.3 release notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Temporal Server versions are running in production and treat any instance below v1.30.7 (1.30 branch) or v1.31.3 (1.31 branch) as exposed; begin emergency change planning to upgrade to v1.30.7 or v1.31.3 as applicable, and in the interim inventory all persisted Schedules for exclusion calendars that fully negate their cadence, deleting or disabling any suspicious Schedule and terminating its backing Workflow to stop ongoing CPU consumption. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
Same weakness CWE-606 – Unchecked Input for Loop Condition
View allShare
External POC / Exploit Code
Leaving vuln.today