Executive brief
Temporal's ringpop-go library provides distributed membership management via the SWIM gossip protocol. A network peer can send malicious label updates that bypass configured size limits, causing memory exhaustion and bandwidth waste that may crash the process. Only availability is affected; no data confidentiality or integrity risk was identified.
Technical details
The SWIM membership protocol enforces label key/value/count size limits on locally-set labels but fails to validate the same limits on labels received from peer nodes during membership updates. An unauthenticated network peer reaching the TChannel listener can repeatedly submit labels exceeding configured LabelOptions limits, which are retained in the member list and re-gossiped, allowing resource consumption to exceed bounds. The fix adds validation of peer-supplied label maps before retention or dissemination.
Affected products
- Temporal ringpop-go versions prior to fix (exact version not specified)
Timeline
- 2026-09-21: disclosed