The temporalio/tchannel-go library failed to validate the one‑byte checksum‑type field in inbound TChannel call frames. An attacker can complete the normal handshake and then send a call request containing an unsupported checksum type. The parser interprets that byte as an index into a four‑entry checksum pool, resulting in an index out of bounds and an unrecovered Go panic while reading the connection. The panic terminates the hosting process, causing the application to become unavailable. The vulnerability is a classic array over‑indexing problem (CWE‑129) and leads to loss of availability only; there is no direct impact on data confidentiality or integrity.

Temporal Technologies, Inc. – the temporalio/tchannel-go library. All releases prior to v1.22.1 are affected; the fix is included in v1.22.1 and later. No specific operating system or deployment platform restrictions are described, so any environment that runs the library and exposes a TChannel listener to external traffic is potentially vulnerable.

The CVSS score of 8.7 points to a high severity Remote Denial of Service. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the TChannel listener; a malicious peer can reach the listener via the standard handshake, send the crafted frame, and terminate the process. The impact is limited to availability, with no identified confidentiality or integrity effects.