CVE-2026-16652 (GCVE-0-2026-16652)

Vulnerability from cvelistv5 – Published: 2026-09-21 11:23 – Updated: 2026-09-21 15:33
VLAI
Title
Temporal Server Schedule exclusion search can cause excessive CPU consumption
Summary
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:32 UTC
CWE
  • CWE-606 - Unchecked Input for Loop Condition
Assigner
Temporal CNA under the mitre root
CNA scorecard A 97/100 over 15 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Temporal Technologies, Inc. Temporal Server Affected: 1.17.0 , ≤ 1.29.7 (semver)
Affected: 1.30.0 , < 1.30.7 (semver)
Affected: 1.31.0 , < 1.31.3 (semver)
    cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
An external security researcher who reported this issue responsibly to Temporal Technologies
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16652",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:32:53.335177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:33:15.387Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "cpes": [
            "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Schedules"
          ],
          "packageName": "go.temporal.io/server",
          "product": "Temporal Server",
          "programFiles": [
            "service/worker/scheduler/spec.go"
          ],
          "programRoutines": [
            {
              "name": "CompiledSpec.GetNextTime"
            }
          ],
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThanOrEqual": "1.29.7",
              "status": "affected",
              "version": "1.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.30.7",
              "status": "affected",
              "version": "1.30.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.31.3",
              "status": "affected",
              "version": "1.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.\u003c/p\u003e"
            }
          ],
          "value": "In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTemporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.\u003c/p\u003e"
            }
          ],
          "value": "Temporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Availability degradation or denial of service caused by excessive CPU consumption and a persistent Schedule retry condition. No confidentiality or integrity impact was identified."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606: Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T11:23:47.298Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "name": "Fix pull request",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/pull/11014"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720"
        },
        {
          "name": "Temporal Server 1.30.7",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
        },
        {
          "name": "Temporal Server 1.31.3",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Temporal Server Schedule exclusion search can cause excessive CPU consumption",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUntil upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.\u003c/p\u003e"
            }
          ],
          "value": "Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2026-16652",
    "datePublished": "2026-09-21T11:23:47.298Z",
    "dateReserved": "2026-07-22T18:08:55.806Z",
    "dateUpdated": "2026-09-21T15:33:15.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-16652",
      "date": "2026-11-09",
      "epss": "0.00466",
      "percentile": "0.40604"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pkg.go.dev",
                "cpes": [
                  "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "Schedules"
                ],
                "packageName": "go.temporal.io/server",
                "product": "Temporal Server",
                "programFiles": [
                  "service/worker/scheduler/spec.go"
                ],
                "programRoutines": [
                  {
                    "name": "CompiledSpec.GetNextTime"
                  }
                ],
                "repo": "https://github.com/temporalio/temporal",
                "vendor": "Temporal Technologies, Inc.",
                "versions": [
                  {
                    "lessThanOrEqual": "1.29.7",
                    "status": "affected",
                    "version": "1.17.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.30.7",
                    "status": "affected",
                    "version": "1.30.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.31.3",
                    "status": "affected",
                    "version": "1.31.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@temporal.io"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Temporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data."
          }
        ],
        "id": "CVE-2026-16652",
        "lastModified": "2026-09-22T19:40:05.870",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security@temporal.io",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-16652",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:32:53.335177Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-21T12:17:10.400",
        "references": [
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal/pull/11014"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
          }
        ],
        "sourceIdentifier": "security@temporal.io",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-606"
              }
            ],
            "source": "security@temporal.io",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16652",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-21T15:32:53.335177Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-21T15:33:08.865Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://pkg.go.dev",
              "cpes": [
                "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "Schedules"
              ],
              "packageName": "go.temporal.io/server",
              "product": "Temporal Server",
              "programFiles": [
                "service/worker/scheduler/spec.go"
              ],
              "programRoutines": [
                {
                  "name": "CompiledSpec.GetNextTime"
                }
              ],
              "repo": "https://github.com/temporalio/temporal",
              "vendor": "Temporal Technologies, Inc.",
              "versions": [
                {
                  "lessThanOrEqual": "1.29.7",
                  "status": "affected",
                  "version": "1.17.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.30.7",
                  "status": "affected",
                  "version": "1.30.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.31.3",
                  "status": "affected",
                  "version": "1.31.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIn Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.\u003c/p\u003e"
                }
              ],
              "value": "In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound."
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eTemporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.\u003c/p\u003e"
                }
              ],
              "value": "Temporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "Availability degradation or denial of service caused by excessive CPU consumption and a persistent Schedule retry condition. No confidentiality or integrity impact was identified."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-606",
                  "description": "CWE-606: Unchecked Input for Loop Condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-21T11:23:47.298Z",
            "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
            "shortName": "Temporal"
          },
          "references": [
            {
              "name": "Fix pull request",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/temporalio/temporal/pull/11014"
            },
            {
              "name": "Fix commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720"
            },
            {
              "name": "Temporal Server 1.30.7",
              "tags": [
                "release-notes"
              ],
              "url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
            },
            {
              "name": "Temporal Server 1.31.3",
              "tags": [
                "release-notes"
              ],
              "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUpgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.\u003c/p\u003e"
                }
              ],
              "value": "Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Temporal Server Schedule exclusion search can cause excessive CPU consumption",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUntil upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.\u003c/p\u003e"
                }
              ],
              "value": "Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "assignerShortName": "Temporal",
        "cveId": "CVE-2026-16652",
        "datePublished": "2026-09-21T11:23:47.298Z",
        "dateReserved": "2026-07-22T18:08:55.806Z",
        "dateUpdated": "2026-09-21T15:33:15.387Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.