CVE-2026-65653

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

• CWE-129

• https://github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc1881df0/fragmenting_reader.go#L256-L308
• https://github.com/temporalio/tchannel-go/commit/0cb017f6870a8420695abeb9a4560d39dadc4e2e
• https://github.com/temporalio/tchannel-go/commit/1dcfa67262ecd56a24f12940f4082549190cb5d1
• https://github.com/temporalio/tchannel-go/commit/8d8ca17342b3620d3a6d5c1a825145595e7588ff
• https://github.com/temporalio/tchannel-go/pull/14
• https://github.com/temporalio/tchannel-go/tree/v1.22.1

Published

Sep 21, 2026

Last Modified

Sep 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65646Improper neutralization of special elements in in Plesk's DN…9.9
• CVE-2026-65647Improper symlink resolution before file access in Plesk allo…8.7
• CVE-2026-6565The Style Kits – Advanced Theme Styles for Elementor, Elemen…6.4
• CVE-2026-65650Elgg before 7.0.0 does not check image dimensions to prevent…4.3
• CVE-2026-65651temporalio/sqlparser accepts SQL containing deeply nested un…8.7
• CVE-2026-65652github.com/temporalio/tchannel-go did not validate the one-b…8.7
• CVE-2026-65654github.com/temporalio/ringpop-go enforces configured LabelOp…8.7
• CVE-2026-65655When OAuth authentication is enabled and browser-facing TLS …2.3
• CVE-2026-65656Improper neutralization of special elements used in a comman…7.8
• CVE-2026-65657Use after free in Microsoft Office allows an unauthorized at…7.8
• CVE-2026-65658Deserialization of untrusted data in Microsoft Office ShareP…8.8
• CVE-2026-6566The Photo Gallery, Sliders, Proofing and Themes – NextGEN Ga…4.3