CVE-2026-65652: TChannel-Go Checksum Validation DoS Flaw

CVE-2026-65652 Overview

CVE-2026-65652 is a remote denial-of-service vulnerability in github.com/temporalio/tchannel-go, a Go implementation of the TChannel network multiplexing and framing protocol. The library fails to validate the one-byte checksum-type field in inbound TChannel call frames. A remote peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, triggering an unrecovered Go panic on the connection read goroutine and terminating the hosting process. The flaw is tracked under [CWE-129] (Improper Validation of Array Index).

Critical Impact
Any unauthenticated network peer able to reach the listener can crash the hosting process, disrupting availability of Temporal and other services that embed tchannel-go.

Affected Products

github.com/temporalio/tchannel-go prior to v1.22.1
Applications embedding the vulnerable tchannel-go library and exposing listeners to untrusted peers
Temporal deployments using affected versions of the TChannel Go transport

Discovery Timeline

2026-09-21 - CVE-2026-65652 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65652

Vulnerability Analysis

The vulnerability resides in the TChannel frame parser. After a successful init handshake, a peer can transmit a call request frame whose header includes a checksum-type byte. The library treats this byte as an index into a fixed-size array (checksumPools) containing four entries, one per supported checksum algorithm. Because no bounds check or membership check is performed, any value outside the supported range causes an out-of-bounds array access. Go converts this into a runtime panic that is not recovered on the connection read goroutine, which propagates and terminates the entire hosting process. The impact is limited to availability; the flaw does not expose memory contents or permit code execution.

Root Cause

The root cause is missing input validation on an attacker-controlled index value. The checksum-type field arrives from an untrusted peer, but the parser dereferences it directly against the checksum pool array without verifying that the value corresponds to a known ChecksumType. This is a textbook [CWE-129] issue: improper validation of an array index derived from untrusted input.

Attack Vector

Exploitation requires only network reachability to a TChannel listener. The attacker performs the standard init handshake and then sends a single malformed call request frame with an invalid checksum-type byte. No authentication, user interaction, or privileged access is needed. Because the panic occurs on the shared read goroutine and is not recovered, a single malformed frame can terminate the process, denying service to all clients of the host.

// Security patch in checksum.go (commit 0cb017f)
// Return errors instead of panicking on malformed call frames
 package tchannel
 
 import (
+	"errors"
 	"hash"
 	"hash/crc32"
 	"sync"
 )
 
 var checksumPools [checksumCount]sync.Pool
 
+var errInvalidChecksumType = errors.New("peer sent an unknown checksum type")
+
 // A ChecksumType is a checksum algorithm supported by TChannel for checksumming call bodies
 type ChecksumType byte

Source: GitHub Commit 0cb017f

// Security patch in fragmenting_reader.go (commit 0cb017f)
// Additional error paths that previously could panic
 	errMismatchedChecksumTypes  = errors.New("peer returned different checksum types between fragments")
 	errMismatchedChecksums      = errors.New("different checksums between peer and local")
 	errChunkExceedsFragmentSize = errors.New("peer chunk size exceeds remaining data in fragment")
+	errEmptyFragment            = errors.New("peer fragment contained no chunks")
 	errAlreadyReadingArgument   = errors.New("already reading argument")
 	errNotReadingArgument       = errors.New("not reading argument")
 	errMoreDataInArgument       = errors.New("closed argument reader when there is more data available to read")

Source: GitHub Commit 0cb017f

Detection Methods for CVE-2026-65652

Indicators of Compromise

Abrupt termination of processes embedding tchannel-go, with Go runtime panic stack traces referencing checksum.go or reqres.go in logs.
Repeated TChannel connections from a single peer immediately followed by process restarts or service unavailability.
Init handshakes followed by call request frames containing checksum-type byte values outside the supported set (0-3).

Detection Strategies

Inspect application logs and container orchestration events for unexpected crashes of services embedding tchannel-go, particularly Temporal server components.
Deploy network monitoring on TChannel ports to flag call request frames whose checksum-type field falls outside the four defined algorithm values.
Correlate process restart events with recent inbound TChannel connections to identify likely triggering peers.

Monitoring Recommendations

Enable structured logging and panic recovery instrumentation on all Go services exposing TChannel listeners so crash traces are captured before process exit.
Track connection-level metrics (established, aborted, crashed) on TChannel endpoints and alert on abnormal restart frequency.
Forward crash telemetry and network flow data to a centralized analytics platform for correlation across hosts.

How to Mitigate CVE-2026-65652

Immediate Actions Required

Upgrade github.com/temporalio/tchannel-go to v1.22.1 or later in all applications that consume the library.
Rebuild and redeploy dependent services, including Temporal server binaries, with the patched dependency.
Restrict network exposure of TChannel listeners to trusted peers using firewall rules, service mesh policy, or network segmentation until patching completes.

Patch Information

The fix is available in the tchannel-go v1.22.1 release. The relevant changes are delivered in commits 0cb017f and a690415, and were merged via Pull Request #14. The patched parser returns errInvalidChecksumType instead of indexing into checksumPools with an attacker-controlled value, converting a fatal panic into a recoverable error on the connection.

Workarounds

Place TChannel listeners behind an authenticated proxy or mTLS-terminating gateway that only forwards traffic from known peers.
Apply network ACLs to restrict TChannel ports to internal, trusted CIDR ranges pending upgrade.
Run affected services under a supervisor with rapid restart policies to reduce downtime while patching is in progress.

bash

# Upgrade the dependency in a Go module
go get github.com/temporalio/tchannel-go@v1.22.1
go mod tidy
go build ./...

# Verify the resolved version
go list -m github.com/temporalio/tchannel-go