tchannel-go EUVD-2026-83893

Requires the application to expose a TChannel listener that untrusted network peers can reach; the attacker must be able to complete the standard TChannel initialization handshake and then send one call request frame with a checksum-type byte outside the four supported values. No authentication and no user interaction are required (PR:N/UI:N/AC:L). The principal limiting factor is deployment topology: TChannel is typically an internal service-to-service RPC transport, so risk is realized only where the listener is reachable by untrusted or multi-tenant peers rather than confined to a trusted internal mesh. Fixed in tchannel-go v1.22.1 (PR #14).

This is a genuine, high-confidence remote denial-of-service issue whose real-world priority hinges almost entirely on exposure. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) yields 8.7 and is internally consistent with the description: a network-reachable, unauthenticated peer can crash the hosting process, with availability the sole impact (VC:N/VI:N). CWE-129 (improper validation of array index) is accurate - an unsupported one-byte checksum-type value is used to select a checksum handler, and the pre-patch code path returns no valid handler, producing an unrecovered Go panic on the connection read goroutine that terminates the whole process. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no evidence of active exploitation; the signal set therefore points to 'no public exploit identified at time of analysis' despite the high base score. The score is elevated primarily by the unauthenticated network vector plus VA:H, not by demonstrated exploitation. The critical mitigating factor not captured in the raw score is deployment context: TChannel listeners are typically internal RPC endpoints, so the flaw is only meaningfully exploitable where the listener is reachable by untrusted peers. A fix is confirmed available (PR #14, merged, released in v1.22.1), which lowers residual risk for anyone able to patch. Net: a real availability bug worth prioritizing for internet- or multi-tenant-exposed listeners, but not an emergency for internal-only service meshes.

An attacker who can reach an application's TChannel listener completes the normal initialization handshake and sends a single call request whose one-byte checksum-type field is set to an unsupported value. The parser indexes the invalid type into the four-entry checksum pool with no validation, triggering an unrecovered Go panic on the read goroutine that crashes the entire hosting process. No authentication or user interaction is required (PR:N/UI:N); no public exploit code is referenced in the input, though the trivial trigger and available source/commit make one straightforward to construct.