CVE-2024-2689: temporal technologies, inc. temporal server Improper Input Validation
Vulnerability summary
CVE-2024-2689 is a medium (CVSS 4.4) Improper Input Validation vulnerability in temporal technologies, inc. temporal server. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.6% of scored vulnerabilities.
Timeline
- 03-04-2024PublishedVulnerability first disclosed.
- 27-08-2025Last modifiedVulnerability information updated.
Description
Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.4MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
0.00 pp
From 0.49% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Github.com/temporalio1 product
- temporal≥ 1.22.0-rc1, < 1.22.7 | ≥ 1.21.0, < 1.21.6 | < 1.20.5
Go.temporal.io1 product
- server≥ 1.22.0-rc1, < 1.22.7
Temporal technologies, inc.1 product
- temporal server< 1.20.5 | ≥ 1.21.0, < 1.21.6 | ≥ 1.22.0, < 1.22.7
3 vendors · 3 products
