Temporal's tchannel-go library contains a flaw where a call fragment that includes checksum metadata but omits any length‑prefixed argument chunks is accepted. The fragment reader leaves its chunk slice empty and then attempts to access the first element unconditionally, causing a Go slice‑bounds panic on a library‑created dispatch goroutine. The unhandled panic terminates the hosting application process, resulting in a denial of service. The vulnerability is categorized as CWE‑129. No confidentiality or integrity compromise is reported.

The affected component is the Temporal Technologies, Inc. library temporalio/tchannel-go. Any build of this library older than v1.22.1 contains the unguarded fragment parsing logic. Applications that embed this library and expose a TChannel listener to untrusted peers are susceptible to the attack. The official solution is to upgrade to version v1.22.1 or later, where the library rejects fragments containing no argument chunks before indexing the chunk slice.

The CVSS base score of 8.7 reflects a high‑severity denial of service. The EPSS score is not available, so the baseline exploit likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is exploitable via a malformed TChannel call fragment sent over the network, the attack vector is remote. The impact is limited to availability, with no evidence of confidentiality or integrity damage.