The temporalio/ringpop-go library enforces configured limits on label changes made locally but fails to apply these limits to label maps received from peers during SWIM membership changes. An attacker able to reach a Ringpop TChannel listener can repeatedly send membership updates containing label keys, values, or counts that exceed configured limits. These labels are accepted and propagated to other peers, resulting in unbounded memory and bandwidth usage. The flaw is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). The fix involves validating peer-supplied label maps before retention or dissemination, but no patch link or vendor advisory is provided in the data.

An attacker with network access to a live Ringpop TChannel listener can cause excessive memory and gossip bandwidth consumption by submitting large or numerous label changes. This can degrade or disrupt the availability of the hosting process. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by validating peer-supplied label maps before retention or dissemination, but no official patch or fix link is provided in the input data. Until a patch is available, restricting network access to Ringpop TChannel listeners and monitoring for unusual membership update traffic may help mitigate risk.