CyberRota Analysis
AI-GeneratedThe vulnerability affects the TChannel implementation in GitHub's temporalio/tchannel-go, where the one-byte checksum-type field in inbound call frames is not properly validated. This flaw allows a remote attacker to exploit the system by sending a call request with an unsupported checksum type, leading to an unrecovered panic and resulting in a denial of service for the hosting application. Organizations utilizing this library, especially those exposing their listeners to untrusted network peers, should prioritize addressing this issue to maintain service availability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.