github - ghsa-p768-c3pr-6459

ghsa-p768-c3pr-6459

Vulnerability from github

Published

2025-09-15 15:31

Modified

2025-09-15 21:51

Severity ?

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Summary

Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling

Details

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation. This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.temporal.io/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.temporal.io/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.27.0-126.0"
            },
            {
              "fixed": "1.27.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.temporal.io/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.28.0-129.0"
            },
            {
              "fixed": "1.28.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-8396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T21:51:27Z",
    "nvd_published_at": "2025-09-15T15:15:55Z",
    "severity": "MODERATE"
  },
  "details": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation. This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.",
  "id": "GHSA-p768-c3pr-6459",
  "modified": "2025-09-15T21:51:27Z",
  "published": "2025-09-15T15:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8396"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/temporalio/temporal"
    },
    {
      "type": "WEB",
      "url": "https://github.com/temporalio/temporal/releases/tag/v1.26.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/temporalio/temporal/releases/tag/v1.27.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/temporalio/temporal/releases/tag/v1.28.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling"
}

CVE-2025-8396 (GCVE-0-2025-8396)

Vulnerability from cvelistv5

Published

2025-09-15 14:13

Modified

2025-09-15 14:52

Severity ?

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.

References

▼	URL	Tags
	https://github.com/temporalio/temporal/releases/tag/v1.26.3
	https://github.com/temporalio/temporal/releases/tag/v1.27.3
	https://github.com/temporalio/temporal/releases/tag/v1.28.1

Impacted products

	Vendor	Product	Version
	Temporal	OSS Server	Version: 0 ≤ Version: 1.27.0 ≤ Version: 1.28.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8396",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-15T14:51:41.610605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T14:52:27.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/temporalio/temporal",
          "defaultStatus": "unaffected",
          "modules": [
            "default claim mapper"
          ],
          "packageName": "temporal",
          "platforms": [
            "Linux",
            "Windows",
            "MacOS"
          ],
          "product": "OSS Server",
          "programFiles": [
            "default_jwt_claim_mapper.go"
          ],
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal",
          "versions": [
            {
              "lessThan": "1.26.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.3",
              "status": "affected",
              "version": "1.27.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.28.1",
              "status": "affected",
              "version": "1.28.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."
            }
          ],
          "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.\u003cp\u003eThis issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). \u003cspan style=\"background-color: rgb(252, 252, 252);\"\u003eTemporal Cloud services are not impacted.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:13:26.507Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.26.3"
        },
        {
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.27.3"
        },
        {
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.28.1"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to a fixed release: \u003ccode\u003ev1.26.3\u003c/code\u003e, \u003ccode\u003ev1.27.3\u003c/code\u003e, \u003ccode\u003ev1.28.1\u003c/code\u003e or later (latest recommended)."
            }
          ],
          "value": "Upgrade to a fixed release: v1.26.3, v1.27.3, v1.28.1 or later (latest recommended)."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use mTLS, or bring your own claim mapper."
            }
          ],
          "value": "Use mTLS, or bring your own claim mapper."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2025-8396",
    "datePublished": "2025-09-15T14:13:26.507Z",
    "dateReserved": "2025-07-30T20:55:26.996Z",
    "dateUpdated": "2025-09-15T14:52:27.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted