{"cve":"CVE-2025-1243","nvd":{"published":"2025-02-12T01:15:09.073","modified":"2026-06-17T08:38:40.033","status":"Deferred","description":"The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the `update response` field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025)  with a proxy leveraging the api-go library before version 1.44.1.\n\nOther data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":2.0},"cvss_v3":null,"cwes":["CWE-311"],"references":["https://github.com/temporalio/api-go/releases/tag/v1.44.1","https://temporal.io/blog/announcing-a-new-operation-workflow-update"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:59:18.731010617+00:00"},"epss":{"cve":"CVE-2025-1243","score":0.00093,"percentile":0.00525,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q9w6-cwj4-gf4p","url":"https://osv.dev/vulnerability/GHSA-q9w6-cwj4-gf4p","summary":"Unencrypted transmission in Temporal api-go library","modified":"2026-09-10T03:49:47.729224097Z","packages":[{"ecosystem":"Go","name":"go.temporal.io/api","purl":"pkg:golang/go.temporal.io/api","ranges":["<1.44.1"],"fixed":["1.44.1"]}]},{"id":"GO-2025-3462","url":"https://osv.dev/vulnerability/GO-2025-3462","summary":"Unencrypted transmission in Temporal api-go library in go.temporal.io/api","modified":"2026-02-04T03:37:42.410613Z","packages":[{"ecosystem":"Go","name":"go.temporal.io/api","purl":"pkg:golang/go.temporal.io/api","ranges":["<1.44.1"],"fixed":["1.44.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}