What’s Vulnerable › Vulnerabilities

CVE-2025-8396

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-15 · updated 2026-06-17
• Weakness: CWE-770

Description

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.

Affected products

• Temporal OSS Server: before 1.26.3; from 1.27.0 before 1.27.3; from 1.28.0 before 1.28.1 — fixed in 1.26.3, 1.27.3, 1.28.1

How to fix

Upgrade to a fixed version: Temporal OSS Server 1.26.3, 1.27.3, 1.28.1. Check the vendor advisory for mitigations.

References

• https://github.com/temporalio/temporal/releases/tag/v1.26.3
• https://github.com/temporalio/temporal/releases/tag/v1.27.3
• https://github.com/temporalio/temporal/releases/tag/v1.28.1

Get alerted when CVE-2025-8396 or the next vulnerability affects your stack