Executive brief
Temporal's tchannel-go library, used for RPC communication, fails to validate the checksum algorithm type in incoming requests. An attacker on the network can send a malformed request with an invalid checksum type, causing the library to crash and terminate the entire process. This results in a denial of service against any application using this library to accept remote connections.
Technical details
The vulnerability is an out-of-bounds array access in the checksum validation logic. The one-byte checksum-type field in inbound TChannel call frames is used directly as an index into a four-entry checksum pool without bounds checking. An unauthenticated network peer can complete the TChannel handshake and send a call request with an unsupported checksum type value (outside 0–3), causing an unrecovered Go panic in the connection read goroutine and process termination.
Affected products
- Temporal tchannel-go prior to fix
Timeline
- 2026-09-21: disclosed