Temporalio Tchannel Go
Monthly
Unauthenticated remote denial of service in github.com/temporalio/tchannel-go (the Go implementation of the TChannel RPC protocol) before v1.22.1 lets any network peer that can complete the standard TChannel initialization handshake crash the hosting process. A crafted call fragment that carries checksum metadata but contains no length-prefixed argument chunks leaves the fragment reader's chunk slice empty, and the unconditional selection of the first element triggers an unrecovered Go slice-bounds panic on a library-created dispatch goroutine, terminating the process. There is no confidentiality or integrity impact, exploitation requires network reachability to a TChannel listener exposed to untrusted peers, and no public exploit code was identified at time of analysis (not confirmed actively exploited / not in CISA KEV); the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Remote denial of service in temporalio/tchannel-go allows any network peer that can reach a TChannel listener to crash the hosting process: after completing the standard TChannel initialization handshake, the peer sends a call frame whose one-byte checksum-type field carries an unsupported value, which the parser uses directly as an index into a four-entry checksum pool and thereby triggers an unrecovered Go panic on the connection's read goroutine. Only availability is affected (the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with no confidentiality or integrity impact), and exploitation is unauthenticated with no user interaction, requiring only that a TChannel listener be reachable by untrusted or multi-tenant peers rather than confined to a trusted internal mesh. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; a vendor patch is available and the issue is fixed in v1.22.1 (PR #14), so priority is driven almost entirely by listener exposure.
Unauthenticated remote denial of service in github.com/temporalio/tchannel-go (the Go implementation of the TChannel RPC protocol) before v1.22.1 lets any network peer that can complete the standard TChannel initialization handshake crash the hosting process. A crafted call fragment that carries checksum metadata but contains no length-prefixed argument chunks leaves the fragment reader's chunk slice empty, and the unconditional selection of the first element triggers an unrecovered Go slice-bounds panic on a library-created dispatch goroutine, terminating the process. There is no confidentiality or integrity impact, exploitation requires network reachability to a TChannel listener exposed to untrusted peers, and no public exploit code was identified at time of analysis (not confirmed actively exploited / not in CISA KEV); the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Remote denial of service in temporalio/tchannel-go allows any network peer that can reach a TChannel listener to crash the hosting process: after completing the standard TChannel initialization handshake, the peer sends a call frame whose one-byte checksum-type field carries an unsupported value, which the parser uses directly as an index into a four-entry checksum pool and thereby triggers an unrecovered Go panic on the connection's read goroutine. Only availability is affected (the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with no confidentiality or integrity impact), and exploitation is unauthenticated with no user interaction, requiring only that a TChannel listener be reachable by untrusted or multi-tenant peers rather than confined to a trusted internal mesh. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; a vendor patch is available and the issue is fixed in v1.22.1 (PR #14), so priority is driven almost entirely by listener exposure.