CVE-2024-2689

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.

• CWE-20

• https://github.com/temporalio/temporal/releases
• https://github.com/temporalio/temporal/releases

Published

Apr 3, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26884In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26885In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26886In the Linux kernel, the following vulnerability has been re…6.5
• CVE-2024-26887In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26888In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26889In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26890In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26891In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26892In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26893In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26894In the Linux kernel, the following vulnerability has been re…6
• CVE-2024-26895In the Linux kernel, the following vulnerability has been re…7.8