An unauthenticated remote denial of service vulnerability in Temporal tchannel-go allows attackers to terminate applications by sending malformed network packets.

This vulnerability (CWE-129) occurs because the library fails to reject TChannel call fragments that lack length-prefixed argument chunks, leading to an out-of-bounds index access and a subsequent Go process panic. The flaw is exploitable by any unauthenticated remote peer capable of establishing a connection to the listener.

The ability for an unauthenticated attacker to remotely crash a service poses a significant risk to business continuity. Given the CVSS score of 8.7, this is classified as a high-severity issue, as it permits the disruption of critical infrastructure without requiring prior access or interaction. Successful exploitation would result in service downtime and potential cascading failures in distributed systems relying on this library.

Immediate Action: Update the dependency to version 1.22.1 or later to ensure the library properly validates TChannel fragments before processing.

Proactive Monitoring: Monitor service logs for unexpected process terminations or frequent service restarts that may indicate exploitation attempts.

Compensating Controls: Implement network-level access controls or firewalls to restrict inbound traffic to the affected service to known, trusted peers only.

Public Exploit Available: Unknown

This vulnerability represents a critical availability risk for any application utilizing tchannel-go. Given the high CVSS score and the ease of exploitation, security teams should prioritize updating this library across all production environments immediately to prevent potential service disruption.