CyberRota Analysis
AI-GeneratedThe vulnerability affects the TChannel implementation in GitHub's temporalio/tchannel-go library, where it fails to properly handle malformed call fragments, leading to a slice-bounds panic. This issue can be exploited by a remote attacker to induce a denial of service, causing the hosting application to terminate unexpectedly. Organizations using this library, particularly those exposing their listeners to untrusted network peers, should prioritize addressing this vulnerability to maintain service availability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.