CVE-2025-8396

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-8396", "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968", "state": "PUBLISHED", "assignerShortName": "Temporal", "dateReserved": "2025-07-30T20:55:26.996Z", "datePublished": "2025-09-15T14:13:26.507Z", "dateUpdated": "2025-09-15T14:52:27.444Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/temporalio/temporal", "defaultStatus": "unaffected", "modules": ["default claim mapper"], "packageName": "temporal", "platforms": ["Linux", "Windows", "MacOS"], "product": "OSS Server", "programFiles": ["default_jwt_claim_mapper.go"], "repo": "https://github.com/temporalio/temporal", "vendor": "Temporal", "versions": [{"lessThan": "1.26.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "1.27.3", "status": "affected", "version": "1.27.0", "versionType": "semver"}, {"lessThan": "1.28.1", "status": "affected", "version": "1.28.0", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."}], "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet)."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.<p>This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). <span style=\"background-color: rgb(252, 252, 252);\">Temporal Cloud services are not impacted.</span></p>"}], "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "61241ed8-fa44-4f23-92db-b8c443751968", "shortName": "Temporal", "dateUpdated": "2025-09-15T14:13:26.507Z"}, "references": [{"url": "https://github.com/temporalio/temporal/releases/tag/v1.26.3"}, {"url": "https://github.com/temporalio/temporal/releases/tag/v1.27.3"}, {"url": "https://github.com/temporalio/temporal/releases/tag/v1.28.1"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to a fixed release: <code>v1.26.3</code>, <code>v1.27.3</code>, <code>v1.28.1</code> or later (latest recommended)."}], "value": "Upgrade to a fixed release: v1.26.3, v1.27.3, v1.28.1 or later (latest recommended)."}], "source": {"discovery": "INTERNAL"}, "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use mTLS, or bring your own claim mapper."}], "value": "Use mTLS, or bring your own claim mapper."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-15T14:51:41.610605Z", "id": "CVE-2025-8396", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-15T14:52:27.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8396", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-15T14:51:41.610605Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-15T14:51:46.097Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/temporalio/temporal", "vendor": "Temporal", "modules": ["default claim mapper"], "product": "OSS Server", "versions": [{"status": "affected", "version": "0", "lessThan": "1.26.3", "versionType": "semver"}, {"status": "affected", "version": "1.27.0", "lessThan": "1.27.3", "versionType": "semver"}, {"status": "affected", "version": "1.28.0", "lessThan": "1.28.1", "versionType": "semver"}], "platforms": ["Linux", "Windows", "MacOS"], "packageName": "temporal", "programFiles": ["default_jwt_claim_mapper.go"], "collectionURL": "https://github.com/temporalio/temporal", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to a fixed release: v1.26.3, v1.27.3, v1.28.1 or later (latest recommended).", "supportingMedia": [{"type": "text/html", "value": "Upgrade to a fixed release: <code>v1.26.3</code>, <code>v1.27.3</code>, <code>v1.28.1</code> or later (latest recommended).", "base64": false}]}], "references": [{"url": "https://github.com/temporalio/temporal/releases/tag/v1.26.3"}, {"url": "https://github.com/temporalio/temporal/releases/tag/v1.27.3"}, {"url": "https://github.com/temporalio/temporal/releases/tag/v1.28.1"}], "workarounds": [{"lang": "en", "value": "Use mTLS, or bring your own claim mapper.", "supportingMedia": [{"type": "text/html", "value": "Use mTLS, or bring your own claim mapper.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted.", "supportingMedia": [{"type": "text/html", "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.<p>This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). <span style=\"background-color: rgb(252, 252, 252);\">Temporal Cloud services are not impacted.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "configurations": [{"lang": "en", "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet).", "supportingMedia": [{"type": "text/html", "value": "Using the default claim mapper, with an OSS Temporal server accessible from untrusted clients (i.e. the open internet).", "base64": false}]}], "providerMetadata": {"orgId": "61241ed8-fa44-4f23-92db-b8c443751968", "shortName": "Temporal", "dateUpdated": "2025-09-15T14:13:26.507Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8396", "state": "PUBLISHED", "dateUpdated": "2025-09-15T14:52:27.444Z", "dateReserved": "2025-07-30T20:55:26.996Z", "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968", "datePublished": "2025-09-15T14:13:26.507Z", "assignerShortName": "Temporal"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/temporalio/temporal", "defaultStatus": "unaffected", "modules": ["default claim mapper"], "packageName": "temporal", "platforms": ["Linux", "Windows", "MacOS"], "product": "OSS Server", "programFiles": ["default_jwt_claim_mapper.go"], "repo": "https://github.com/temporalio/temporal", "vendor": "Temporal", "versions": [{"lessThan": "1.26.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "1.27.3", "status": "affected", "version": "1.27.0", "versionType": "semver"}, {"lessThan": "1.28.1", "status": "affected", "version": "1.28.0", "versionType": "semver"}]}], "source": "security@temporal.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and 1.28.1 (i.e., fixed in 1.26.3, 1.27.3, and 1.28.1 and later). Temporal Cloud services are not impacted."}], "id": "CVE-2025-8396", "lastModified": "2026-06-17T10:06:53.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@temporal.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8396", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-15T14:51:41.610605Z", "version": "2.0.3"}}]}, "published": "2025-09-15T15:15:55.280", "references": [{"source": "security@temporal.io", "url": "https://github.com/temporalio/temporal/releases/tag/v1.26.3"}, {"source": "security@temporal.io", "url": "https://github.com/temporalio/temporal/releases/tag/v1.27.3"}, {"source": "security@temporal.io", "url": "https://github.com/temporalio/temporal/releases/tag/v1.28.1"}], "sourceIdentifier": "security@temporal.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security@temporal.io", "type": "Secondary"}]}

{}

{"created": "2025-09-17T10:52:25.928159+00:00", "updated": "2025-09-17T10:52:25.928217+00:00", "vendors": ["temporal", "temporal$PRODUCT$temporal"]}