CVE-2026-65653

Name of the Vulnerable Software and Affected Versions github.com/temporalio/tchannel-go (affected versions not specified)

Description The software fails to reject TChannel call fragments that contain checksum metadata but lack length-prefixed argument chunks. In this scenario, the fragment reader leaves its chunk slice empty and unconditionally attempts to select the first element. A remote network peer can trigger this by sending a malformed call fragment, which can be done as a direct initial call request following the standard initialization handshake. This results in an unrecovered Go slice-bounds panic within a library-created dispatch goroutine, causing the hosting process to terminate and leading to a remote denial of service for applications exposing the listener to untrusted peers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.