Description
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Temporal Technologies | temporalio/tchannel-go | 0.0.0-20150531204735-8d8ca17342b3 – < 1.22.1-0.20260720194454-0cb017f6870a | 1.22.1-0.20260720194454-0cb017f6870a |
References
- First affected source revision product
- Vulnerable zero-chunk fragment handling product
- Direct inbound call route product
- Zero-chunk fragment validation fix patch
- First fixed source revision patch
- Fixed release tag v1.22.1 product