CVE-2026-65652

Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go (affected versions not specified)

Description The software fails to validate the one-byte checksum-type field in inbound TChannel call frames. A remote network peer can complete the standard initialization handshake and send a call request containing an unsupported checksum type. The parser then uses this value as an index into a four-entry checksum pool, triggering an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This results in a remote denial of service for applications exposing the listener to untrusted peers, affecting only availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.