The temporalio/tchannel-go library did not validate the checksum-type field in inbound TChannel call frames. A remote attacker who can reach the listener can complete the handshake and send a call request with an unsupported checksum type. The parser uses this unchecked value as an index into a fixed-size checksum pool, causing an unrecovered Go panic on the connection read goroutine, which terminates the hosting process. This results in a remote denial of service against applications exposing the listener to untrusted peers. The vulnerability is tracked as CWE-129 (Improper Validation of Array Index).

The vulnerability allows remote attackers to cause a denial of service by crashing the hosting process. There is no impact on confidentiality or integrity. The availability of affected applications is at risk if exposed to untrusted network peers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the listener to trusted peers only to reduce exposure to untrusted attackers.