CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination
Remote attackers can crash applications using the tchannel-go library by sending malformed call fragments, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65653?
CVE-2026-65653 is a high-severity denial of service vulnerability in temporalio/tchannel-go, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.
Weakness: CWE-129
Which versions are affected by CVE-2026-65653?
How do I fix CVE-2026-65653?
No fix has been published for CVE-2026-65653 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-65653 being exploited?
There is no known exploitation of CVE-2026-65653 in the wild and no public exploit code.
Sources
Also known as GHSA-vg3p-fxfm-m684.