Temporal Server failed to impose a bound on the amount of work performed while searching for a Schedule's next action time (CWE-606). An attacker with namespace write permissions can create or update a Schedule that includes a fine‑grained cadence and an exclusion calendar rejecting every candidate time. This causes the server to evaluate excluded candidates without a per‑search budget, leading to excessive CPU use in the Frontend and Schedule worker components. A persisted bad specification can also trigger repeated failures and retries of the backing Schedule Workflow, robbing the system of CPU resources until the Schedule is removed or the Workflow stopped. The flaw affects availability only; it does not read or modify any workflow data.

The vulnerability affects Temporal Technologies, Inc. Temporal Server. All deployed instances running a version prior to the released security fixes are impacted. The fix is available in Temporal Server 1.30.7, 1.31.3, and 1.32.0, depending on the minor release line in use. Updating to one of these releases and ensuring scheduler.specMaxIterations remains positive removes the unbounded search.

The CVSS score is 7.1, indicating a high potential impact if exploited. The EPSS score is not available, so an exact exploitation probability cannot be stated, but the lack of a known public exploit and absence from the CISA KEV catalog implies the threat remains limited. The likely attack vector requires an authenticated caller with namespace write permissions, meaning that an insider or a compromised account could craft the malicious Schedule. Without mitigation, repeated or parallel exploitation could deny service to all schedules within the affected namespace.