Medium severityOSV Advisory· Published Sep 15, 2025· Updated Apr 15, 2026
CVE-2025-8396
CVE-2025-8396
Description
Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
go.temporal.io/serverGo | < 1.26.3 | 1.26.3 |
go.temporal.io/serverGo | >= 1.27.0-126.0, < 1.27.3 | 1.27.3 |
go.temporal.io/serverGo | >= 1.28.0-129.0, < 1.28.1 | 1.28.1 |
Affected products
1- Range: dummy-tag, norbert-109, norbert/wip, …
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5News mentions
0No linked articles in our index yet.