CVE-2025-8396 - Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later)

Back Back to CVE browser

MEDIUM

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later)

Published Sep 15, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.

Affected products

Vendor Temporal Product OSS Server Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.26.3
- Version
  1.27.0
  Status
  affected
  Constraints
  <1.27.3
- Version
  1.28.0
  Status
  affected
  Constraints
  <1.28.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Temporal

OSS Server

unaffected

Version	Status	Constraints
0	affected	<1.26.3
1.27.0	affected	<1.27.3
1.28.0	affected	<1.28.1

go.temporal.io/server

Go

Introduced 0 Fixed 1.26.3
go.temporal.io/server

Go

Introduced 1.27.0-126.0 Fixed 1.27.3
go.temporal.io/server

Go

Introduced 1.28.0-129.0 Fixed 1.28.1

Ecosystem	Package	Introduced	Fixed
Go	go.temporal.io/server	0	1.26.3
Go	go.temporal.io/server	1.27.0-126.0	1.27.3
Go	go.temporal.io/server	1.28.0-129.0	1.28.1

Remediation

Vendor solution

Upgrade to a fixed release: v1.26.3, v1.27.3, v1.28.1 or later (latest recommended).

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (6)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-29200		Advisory
https://github.com/advisories/GHSA-p768-c3pr-6459		Advisory
https://github.com/temporalio/temporal/releases/tag/v1.26.3
https://github.com/temporalio/temporal/releases/tag/v1.27.3
https://github.com/temporalio/temporal/releases/tag/v1.28.1
https://nvd.nist.gov/vuln/detail/CVE-2025-8396