{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-16652",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-16652",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-21T11:23:47.298Z",
    "updatedAt": "2026-09-21T15:33:15.387Z",
    "importedAt": "2026-10-24T01:57:55.771Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Temporal Server Schedule exclusion search can cause excessive CPU consumption",
      "summary": "Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.",
      "affected": [
        {
          "vendor": "Temporal Technologies, Inc.",
          "product": "Temporal Server",
          "packageName": "go.temporal.io/server",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.17.0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "1.29.7"
            },
            {
              "version": "1.30.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "1.30.7"
            },
            {
              "version": "1.31.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "1.31.3"
            }
          ]
        }
      ]
    }
  }
}