Ringpop-Go CVE-2026-65654

Exploitation requires network reachability to a live Ringpop TChannel/SWIM gossip listener on an affected version of github.com/temporalio/ringpop-go, plus the application using ringpop's label feature with configured LabelOptions limits. No authentication or user interaction is needed once the listener is reachable, because SWIM membership messages are processed without applying the label limits to peer-supplied maps. The primary limiting factor is exposure: the gossip/membership port is usually an internal cluster-communication interface, so realistic risk is highest where that listener is reachable from untrusted or shared network segments; a node with a properly network-isolated gossip port is largely out of reach for external attackers.

The signals are internally consistent and point to a genuine but bounded availability threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, base 8.7 'High') describes network-reachable, low-complexity, unauthenticated exploitation with high availability impact and explicitly zero confidentiality/integrity impact - matching the description and CWE-770 (uncontrolled resource consumption). This is a real DoS, not a mislabeled high-CVSS artifact, and the vendor score is not availability-inflated the way many auto-generated CRITICAL entries are. However, the score is driven by PR:N/AV:N, which somewhat overstates real-world reach: the attacker must be able to reach a live Ringpop TChannel/SWIM gossip listener, which in typical deployments is an internal cluster-membership port rather than an internet-facing service. EPSS is not provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so there is no evidence of active or imminent mass exploitation. Net: a legitimate patch-worthy availability bug for anyone running the affected library on an exposed or shared network segment, but lower urgency than the 8.7 suggests for operators whose gossip port is network-isolated. No signals directly conflict; the main caveat is exposure of the TChannel listener, which the CVSS PR:N/AV:N does not capture.

An attacker with network reachability to a node's Ringpop TChannel gossip listener repeatedly sends SWIM membership-change messages for many distinct member addresses, each carrying label keys/values/counts that exceed the receiver's configured LabelOptions limits. Because affected versions validate limits only for local label changes, the peer-supplied labels are accepted, retained in the member list, and re-disseminated to other peers, driving memory and gossip-bandwidth growth until the hosting process becomes unavailable. No public exploit code is referenced, but the attack is conceptually simple and requires only a crafted gossip peer.