Temporal Server Denial-of-Service Vulnerability Due to Insufficient Authorization Header Bounds Checking

A denial-of-service vulnerability has been identified in Temporal Server on all platforms, affecting versions prior to 1.26.3, 1.27.3, and 1.28.1. The issue arises from insufficiently specific bounds checking on the authorization header, which could lead to excessive memory allocation. As a result, the server may become unresponsive or fail to handle requests properly. Notably, this vulnerability does not impact Temporal Cloud services.

Impact

Excessive memory allocation leading to denial-of-service conditions on the server.

Remediation

Users can upgrade to Temporal Server versions 1.26.3, 1.27.3, or 1.28.1 to address this vulnerability.