CVE-2026-65654

Name of the Vulnerable Software and Affected Versions github.com/temporalio/ringpop-go (affected versions not specified)

Description The software fails to apply configured LabelOptions limits to label maps received during SWIM membership changes. A network peer with access to a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses. By providing label keys, values, or counts that exceed the receiver's configured limits, the attacker can cause the system to retain and disseminate these labels. This leads to excessive memory and gossip-bandwidth consumption, which may result in the hosting process becoming unavailable. SWIM is a membership protocol used for cluster management.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.