GitHub Advisoryadvisory · Go

GHSA-p768-c3pr-6459 Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling

MEDIUM Published 2025-09-15 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-8396
Ecosystem
Go
Packages
go.temporal.io/server
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
Weaknesses
CWE-770
Reviewed
2025-09-15

Affected packages

• Go go.temporal.io/server: < 1.26.3 → fixed in 1.26.3 • Go go.temporal.io/server: >= 1.27.0-126.0, < 1.27.3 → fixed in 1.27.3 • Go go.temporal.io/server: >= 1.28.0-129.0, < 1.28.1 → fixed in 1.28.1

Description

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation. This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.

Related

Alias · CVE (1)

  • CVE-2025-8396 Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References