---
id: CVE-2026-65653
title: >-
  github.com/temporalio/tchannel-go did not reject TChannel call fragments
  containing checksum metadata but no length-prefixed argument chunks
summary: >-
  github.com/temporalio/tchannel-go did not reject TChannel call fragments
  containing checksum metadata but no length-prefixed argument chunks. The
  fragment reader left its chunk slice empty and then unconditionally selected
  the first elem…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-129
vendor: 'Temporal Technologies, Inc.'
product: github.com/temporalio/tchannel-go
affected:
  - >-
    github.com/temporalio/tchannel-go >= 0.0.0-20150531204735-8d8ca17342b3 <
    1.22.1-0.20260720194454-0cb017f6870a
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:40:05.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65653'
references:
  - url: >-
      https://github.com/temporalio/tchannel-go/blob/8706a1ab5f617efd79dace7ab2d1d80cc1881df0/fragmenting_reader.go#L256-L308
    label: security@temporal.io
  - url: >-
      https://github.com/temporalio/tchannel-go/commit/0cb017f6870a8420695abeb9a4560d39dadc4e2e
    label: security@temporal.io
  - url: >-
      https://github.com/temporalio/tchannel-go/commit/1dcfa67262ecd56a24f12940f4082549190cb5d1
    label: security@temporal.io
  - url: >-
      https://github.com/temporalio/tchannel-go/commit/8d8ca17342b3620d3a6d5c1a825145595e7588ff
    label: security@temporal.io
  - url: 'https://github.com/temporalio/tchannel-go/pull/14'
    label: security@temporal.io
  - url: 'https://github.com/temporalio/tchannel-go/tree/v1.22.1'
    label: security@temporal.io
tags:
  - nvd
  - cve.org
epss: 0.0071
epssPercentile: 0.51449
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T15:28:04.791087Z'
cvssSource: cna
ingestedAt: '2026-09-21T12:36:35.288Z'
---

## Overview

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.