tchannel-go CVE-2026-65653

Exploitation requires network reachability to a TChannel listener that is exposed to untrusted peers, and the attacker must first complete the standard TChannel initialization handshake before sending the malformed call fragment (checksum metadata present, zero length-prefixed argument chunks) on the inbound call path. No authentication, user interaction, or special product configuration beyond running github.com/temporalio/tchannel-go prior to v1.22.1 is needed (PR:N/UI:N/AC:L). The primary LIMITING factor is deployment exposure: TChannel is commonly an internal service-mesh/RPC transport, so realistic risk is confined to environments where that listener accepts connections from untrusted or attacker-controlled network positions; services that bind TChannel only to trusted internal peers are far less exposed.

This is a genuine, well-scoped availability risk rather than an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, base 8.7) is internally consistent with the description: a network-reachable, unauthenticated, low-complexity path that reliably crashes the hosting Go process via an unrecovered slice-bounds panic (CWE-129). No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or automated exploitation - this places it as no public exploit identified at time of analysis, meaning the 8.7 reflects worst-case impact/reachability, not observed weaponization. The impact is strictly availability (VC:N/VI:N/VA:H); there is no confidentiality or integrity exposure, so this is a crash/DoS priority, not a compromise priority. The one caveat that tempers real-world risk: exploitation requires reaching a TChannel listener exposed to untrusted peers, and TChannel is typically an internal service-mesh RPC transport, so blast radius depends heavily on network exposure rather than being internet-facing by default. No SSVC decision data was supplied. Overall: patch promptly where the listener is reachable by untrusted parties, but the low deployment exposure of the protocol and absence of exploitation signals keep it below the tier of an internet-facing pre-auth RCE.

An attacker who can reach a service's TChannel listener completes the standard initialization handshake, then sends a single malformed call fragment carrying checksum metadata but no length-prefixed argument chunks. The fragment reader leaves its chunk slice empty and then indexes element zero, triggering an unrecovered Go slice-bounds panic on a library-created dispatch goroutine that terminates the entire hosting process. No public exploit code was identified, but the malformed-fragment recipe is fully described and trivial to reproduce given the unauthenticated, low-complexity network path.