CVE-2026-65654: Ringpop-Go SWIM Protocol DOS Vulnerability

CVE-2026-65654 Overview

CVE-2026-65654 is a denial-of-service vulnerability in github.com/temporalio/ringpop-go, a Go library implementing the SWIM gossip protocol for scalable, fault-tolerant application clustering. The library enforces configured LabelOptions limits when the local application modifies node labels, but affected versions fail to apply those same limits to label maps received through SWIM membership changes. A network peer able to reach a live Ringpop TChannel listener can submit membership changes containing oversized label keys, values, or counts. Accepted labels are retained in the member list and gossiped to peers, driving unbounded memory and bandwidth consumption. The classification maps to [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A remote unauthenticated peer can exhaust process memory and gossip bandwidth on Ringpop cluster members, making hosting processes unavailable. Availability only; no confidentiality or integrity impact.

Affected Products

github.com/temporalio/ringpop-go (SWIM implementation)
Applications embedding vulnerable ringpop-go versions prior to the fix commits
Clusters exposing TChannel listeners to untrusted network peers

Discovery Timeline

2026-09-21 - CVE-2026-65654 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65654

Vulnerability Analysis

Ringpop-go maintains a membership list synchronized between nodes using the SWIM gossip protocol. Each member entry can carry a label map, and LabelOptions defines maximums for label key size (KeySize), value size (ValueSize), and total label Count. These limits were consistently enforced on the local write path when an application called label mutation APIs. The receive path in swim/memberlist.go, which processes label maps piggybacked on SWIM membership changes from peers, did not perform the same validation. Any labels present on incoming changes were persisted into the local member list and re-disseminated to the rest of the cluster.

Root Cause

The defect is a missing input validation control on peer-supplied data. The internal namespace prefix __ was also unbounded, allowing an attacker to bypass any partial limits by using internal-style keys. Because SWIM gossip amplifies accepted state across all members, a single malicious peer can multiply the resource cost cluster-wide without executing code on any target host.

Attack Vector

An attacker with network reachability to a Ringpop TChannel listener repeatedly submits SWIM changes for distinct member addresses, each carrying label maps with keys, values, or counts that exceed the receiver's LabelOptions limits. No authentication is required. Retained labels grow the member list unboundedly, and each gossip round further increases bandwidth consumption until processes become unresponsive.

// Security patch in swim/labels.go (commit c317eff) — validates peer-supplied label maps
// before they are retained or disseminated.

// validateIncomingLabels checks a whole label map received from a peer: every
// key/value within KeySize/ValueSize, at most Count public labels, and at most
// Count internal (__) labels. Internal labels are bounded here (unlike
// validateLabels, which exempts them) so a peer can't bypass the limits via the
// __ namespace. It returns on the first violation rather than scanning the
// whole map.
func (lo LabelOptions) validateIncomingLabels(labels map[string]string) error {
    public := 0
    internal := 0
    for key, value := range labels {
        if len(key) > lo.KeySize || len(value) > lo.ValueSize {
            return ErrLabelSizeExceeded
        }
        if isInternalLabel(key) {
            internal++
        } else {
            public++
        }
        if public > lo.Count || internal > lo.Count {
            return ErrLabelSizeExceeded
        }
    }
    return nil
}

Source: GitHub Commit c317eff

Detection Methods for CVE-2026-65654

Indicators of Compromise

Rapid, sustained growth of Ringpop process resident memory without a corresponding increase in legitimate cluster membership.
Unusual SWIM gossip bandwidth on TChannel ports, particularly change messages for many distinct, previously unseen member addresses.
Member list entries with abnormally long label keys or values, or label counts exceeding the configured LabelOptions bounds.

Detection Strategies

Inspect membership snapshots and log any label maps whose key length, value length, or count exceed local LabelOptions thresholds.
Correlate SWIM message rates against expected cluster size; flag sources injecting change events for many unknown members over short windows.
Compare deployed ringpop-go module versions against the patched commits c317eff and d0de5fe in software bill of materials (SBOM) tooling.

Monitoring Recommendations

Alert on Go process memory growth and garbage collection pressure trends on hosts running Ringpop-based services (for example, Temporal server components).
Monitor TChannel listener connection sources and reject or rate-limit peers outside the expected cluster IP allowlist.
Track error counters for ErrLabelSizeExceeded after patching to identify ongoing exploitation attempts.

How to Mitigate CVE-2026-65654

Immediate Actions Required

Upgrade github.com/temporalio/ringpop-go to a version containing the fix commits c317eff and d0de5fe, then rebuild and redeploy dependent services.
Restrict network reachability to Ringpop TChannel listeners so only trusted cluster members can send SWIM messages.
Audit running clusters for anomalously large member lists or label maps and restart affected processes after patching.

Patch Information

The fix introduces validateIncomingLabels in swim/labels.go and applies it on the receive path in swim/memberlist.go so peer-supplied label maps are validated against LabelOptions before being retained or disseminated. Internal __-prefixed labels are now bounded, closing the namespace bypass. Review the changes in GitHub Commit c317eff, GitHub Commit d0de5fe, and GitHub Pull Request #22.

Workarounds

Place Ringpop TChannel listeners behind network segmentation, firewall rules, or a service mesh that restricts peers to authenticated cluster members.
Lower LabelOptions.KeySize, ValueSize, and Count to conservative values to reduce the resource cost per accepted malicious label until the patch is deployed.
Add process-level memory limits and automated restart policies so a single node's exhaustion does not cascade across the cluster.

bash

# Update ringpop-go to a patched revision in your Go module
go get github.com/temporalio/ringpop-go@latest
go mod tidy
go build ./...

# Restrict TChannel exposure with host-level firewall rules (example)
# Replace 10.0.0.0/24 with the trusted cluster CIDR and 3000 with the Ringpop port
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP