An unauthenticated remote denial of service vulnerability in Temporal tchannel-go allows attackers to crash hosting processes via malformed network frames.

The software fails to validate the checksum-type field in incoming TChannel frames, leading to an out-of-bounds array index access that triggers an unrecovered Go panic. This vulnerability is exploitable by any unauthenticated network peer capable of reaching the listener.

Successful exploitation of this vulnerability results in the immediate termination of the hosting process, causing a denial of service for applications relying on the affected library. With a CVSS score of 8.7, this flaw poses a significant availability risk to infrastructure components. Organizations may face service outages and operational disruption if the affected services are targeted by attackers.

Immediate Action: Upgrade the tchannel-go dependency to version 1.22.1 or later to implement proper input validation.

Proactive Monitoring: Monitor application logs for frequent service restarts or unexpected Go panic stack traces indicating potential exploitation attempts.

Compensating Controls: Restrict network access to the TChannel listener to trusted peers using firewall rules or network segmentation to prevent unauthorized connections from untrusted sources.

Public Exploit Available: No

Given the high severity of this denial of service vulnerability and its potential for automated exploitation, immediate patching is required. Organizations should identify all applications utilizing the tchannel-go library and prioritize updating the dependency to version 1.22.1 or later to eliminate the risk of service disruption.