{"id":"CVE-2025-8396","state":"PUBLISHED","title":"Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issu","description":"Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.","publishedAt":"2025-09-15T14:13:26.507Z","updatedAt":"2025-09-15T14:52:27.444Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y","source":"Temporal"},"assigner":"Temporal","products":["Temporal OSS Server"],"affected":[{"vendor":"Temporal","product":"OSS Server","packageName":"temporal","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.26.3","versionType":"semver"},{"version":"1.27.0","status":"affected","lessThan":"1.27.3","versionType":"semver"},{"version":"1.28.0","status":"affected","lessThan":"1.28.1","versionType":"semver"}],"collectionURL":"https://github.com/temporalio/temporal","modules":["default claim mapper"],"platforms":["Linux","Windows","MacOS"],"programFiles":["default_jwt_claim_mapper.go"],"repo":"https://github.com/temporalio/temporal"}],"references":["https://github.com/temporalio/temporal/releases/tag/v1.26.3","https://github.com/temporalio/temporal/releases/tag/v1.27.3","https://github.com/temporalio/temporal/releases/tag/v1.28.1"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/8xxx/CVE-2025-8396.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-8396","state":"PUBLISHED","datePublished":"2025-09-15T14:13:26.507Z","dateUpdated":"2025-09-15T14:52:27.444Z","assignerShortName":"Temporal","assignerOrgId":"61241ed8-fa44-4f23-92db-b8c443751968","dateReserved":"2025-07-30T20:55:26.996Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted."}],"affected":[{"vendor":"Temporal","product":"OSS Server","packageName":"temporal","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.26.3","versionType":"semver"},{"version":"1.27.0","status":"affected","lessThan":"1.27.3","versionType":"semver"},{"version":"1.28.0","status":"affected","lessThan":"1.28.1","versionType":"semver"}],"collectionURL":"https://github.com/temporalio/temporal","modules":["default claim mapper"],"platforms":["Linux","Windows","MacOS"],"programFiles":["default_jwt_claim_mapper.go"],"repo":"https://github.com/temporalio/temporal"}],"references":[{"url":"https://github.com/temporalio/temporal/releases/tag/v1.26.3"},{"url":"https://github.com/temporalio/temporal/releases/tag/v1.27.3"},{"url":"https://github.com/temporalio/temporal/releases/tag/v1.28.1"}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Temporal","orgId":"61241ed8-fa44-4f23-92db-b8c443751968","dateUpdated":"2025-09-15T14:13:26.507Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."}],"value":"Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."}],"impacts":[{"capecId":"CAPEC-130","descriptions":[{"lang":"en","value":"CAPEC-130 Excessive Allocation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to a fixed release: <code>v1.26.3</code>, <code>v1.27.3</code>, <code>v1.28.1</code> or later (latest recommended)."}],"value":"Upgrade to a fixed release: v1.26.3, v1.27.3, v1.28.1 or later (latest recommended)."}],"source":{"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Use mTLS, or bring your own claim mapper."}],"value":"Use mTLS, or bring your own claim mapper."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-15T14:51:41.610605Z","id":"CVE-2025-8396","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-15T14:52:27.444Z"}}]}}}