{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8396",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T14:51:41.610605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T14:52:27.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/temporalio/temporal",
          "defaultStatus": "unaffected",
          "modules": [
            "default claim mapper"
          ],
          "packageName": "temporal",
          "platforms": [
            "Linux",
            "Windows",
            "MacOS"
          ],
          "product": "OSS Server",
          "programFiles": [
            "default_jwt_claim_mapper.go"
          ],
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal",
          "versions": [
            {
              "lessThan": "1.26.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.3",
              "status": "affected",
              "version": "1.27.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.28.1",
              "status": "affected",
              "version": "1.28.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."
            }
          ],
          "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.\u003cp\u003eThis issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). \u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eTemporal Cloud services are not impacted.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:13:26.507Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.26.3"
        },
        {
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.27.3"
        },
        {
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.28.1"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to a fixed release: \u003ccode\u003ev1.26.3\u003c/code\u003e, \u003ccode\u003ev1.27.3\u003c/code\u003e, \u003ccode\u003ev1.28.1\u003c/code\u003e or later (latest recommended)."
            }
          ],
          "value": "Upgrade to a fixed release: v1.26.3, v1.27.3, v1.28.1 or later (latest recommended)."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use mTLS, or bring your own claim mapper."
            }
          ],
          "value": "Use mTLS, or bring your own claim mapper."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2025-8396",
    "datePublished": "2025-09-15T14:13:26.507Z",
    "dateReserved": "2025-07-30T20:55:26.996Z",
    "dateUpdated": "2025-09-15T14:52:27.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}