Temporalio Ringpop Go
Monthly
Unauthenticated network peers that can reach a live Ringpop TChannel/SWIM gossip listener can drive memory and gossip-bandwidth exhaustion in github.com/temporalio/ringpop-go, because peer-supplied label maps are retained and re-disseminated without being checked against the application's configured LabelOptions limits. Applications that use ringpop's label feature are affected; repeated membership changes for distinct member addresses carrying oversized label keys, values, or counts inflate the member list and propagate to the whole cluster, degrading and potentially taking down the hosting process (availability only, no confidentiality or integrity impact). Exploitation requires network reachability to the gossip/TChannel port - typically an internal cluster interface - and there is no public exploit identified at time of analysis, though the assessed severity (CVSS 3.1 base 8.7, PR:N, A:H) makes the exposure of that port the decisive risk factor.
Unauthenticated network peers that can reach a live Ringpop TChannel/SWIM gossip listener can drive memory and gossip-bandwidth exhaustion in github.com/temporalio/ringpop-go, because peer-supplied label maps are retained and re-disseminated without being checked against the application's configured LabelOptions limits. Applications that use ringpop's label feature are affected; repeated membership changes for distinct member addresses carrying oversized label keys, values, or counts inflate the member list and propagate to the whole cluster, degrading and potentially taking down the hosting process (availability only, no confidentiality or integrity impact). Exploitation requires network reachability to the gossip/TChannel port - typically an internal cluster interface - and there is no public exploit identified at time of analysis, though the assessed severity (CVSS 3.1 base 8.7, PR:N, A:H) makes the exposure of that port the decisive risk factor.