GitHub.com/temporalio/ringpop-go allows a network peer that can reach a live Ringpop TChannel listener to send SWIM membership changes containing label maps that exceed the receiver's configured limits. The lack of validation on inbound labels results in memory and gossip‑bandwidth consumption exceeding the configured bounds, potentially exhausting resources and causing the hosting process to become unavailable. The vulnerability poses an availability impact only; no confidentiality or integrity compromise was identified.

Temporal Technologies, Inc. provides the ringpop-go library, used within Temporal workflows to manage cluster membership. Versions prior to v0.1.0 do not enforce label limits on inbound gossip, but the specific affected releases are not enumerated in the advisory. Deployments that use ringpop-go without upgrading to v0.1.0 or later are therefore impacted.

The CVSS score of 8.7 indicates a high risk for denial of service. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that mass exploitation is currently not documented. The likely attack vector is a remote actor that can reach the Ringpop TChannel listener, which may be exposed over a network interface. The attacker can repeatedly submit large label maps, triggering resource exhaustion. While there is no authentication required for the gossip path, the mitigation workarounds rely on restricting the listener to trusted members or enforcing mutual TLS.