CVE-2024-2689: Denial of Service if invalid UTF-8 sent

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-03 · updated 2026-06-17
Weakness: CWE-20

Description

Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.

Affected products

Temporal Technologies, Inc. Temporal Server: before 1.20.5; from 1.21.0 before 1.21.6; from 1.22.0 before 1.22.7 — fixed in 1.20.5, 1.21.6, 1.22.7

How to fix

Upgrade to a fixed version: Temporal Technologies, Inc. Temporal Server 1.20.5, 1.21.6, 1.22.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-2689 or the next vulnerability affects your stack