CVE-2025-8396 Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling
Attackers can cause denial of service in Temporal OSS Server via excessive memory allocation triggered by insufficient bounds checking on authorization headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-8396?
CVE-2025-8396 is a medium-severity denial of service vulnerability in Temporal OSS Server, published on 15 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.
Weakness: CWE-770
Which versions are affected by CVE-2025-8396?
7 open source packages ship an affected version, including go.temporal.io/server.
| Package | Affected | Fixed in |
|---|---|---|
go.temporal.io/server Go | All versions | 1.26.3, 1.27.3, 1.28.1 |
go.temporal.io/server Go | All versions | 1.26.3 |
go.temporal.io/server Go | All versions | 1.26.3 |
go.temporal.io/server Go | From 1.27.0-126.0 | 1.27.3 |
go.temporal.io/server Go | From 1.27.0-126.0 | 1.27.3 |
go.temporal.io/server Go | From 1.28.0-129.0 | 1.28.1 |
1 more packages
go.temporal.io/server Go | From 1.28.0-129.0 | 1.28.1 |
How do I fix CVE-2025-8396?
Upgrade go.temporal.io/server to a fixed version for your release line: 1.26.3, 1.27.3 or 1.28.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-8396 being exploited?
There is no known exploitation of CVE-2025-8396 in the wild and no public exploit code.
Sources
Also known as ECHO-845c-6885-6d2a, GHSA-p768-c3pr-6459, GO-2025-3953.