Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for temporalio/sqlparser by Temporal Technologies, Inc.
CVE-2026-65651 (GCVE-0-2026-65651)
Vulnerability from nvd – Published: 2026-09-21 11:34 – Updated: 2026-09-21 15:31
VLAI
EPSS
VEX
Title
temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
Summary
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:30 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Temporal Technologies, Inc. | temporalio/sqlparser |
Affected:
0.0.0-20141206041240-1aae9baceee8 , < 0.0.0-20260721183058-0466b6b405ac
(semver)
|
|
| Temporal Technologies, Inc. | Temporal Server |
Unknown:
0.0.0 , < 0.10.0
(semver)
Affected: 0.10.0 , ≤ 1.29.7 (semver) Affected: 1.30.0 , < 1.30.7 (semver) Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:30:53.004421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:31:05.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"modules": [
"AST",
"Parser"
],
"packageName": "github.com/temporalio/sqlparser",
"product": "temporalio/sqlparser",
"programFiles": [
"ast.go",
"sql.y"
],
"programRoutines": [
{
"name": "Parse"
},
{
"name": "ParseStrictDDL"
},
{
"name": "ParseNext"
},
{
"name": "String"
},
{
"name": "Walk"
},
{
"name": "UnaryExpr.Format"
}
],
"repo": "https://github.com/temporalio/sqlparser",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.0.0-20260721183058-0466b6b405ac",
"status": "affected",
"version": "0.0.0-20141206041240-1aae9baceee8",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Archival",
"Frontend",
"Matching",
"Visibility"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"common/archiver/filestore/queryParser.go",
"common/persistence/visibility/store/query/converter.go",
"common/persistence/visibility/store/sql/query_converter.go",
"service/matching/workers/worker_query_engine.go"
],
"programRoutines": [
{
"name": "queryParser.convertComparisonExpr"
},
{
"name": "QueryConverter.convertComparisonExpr"
},
{
"name": "comparisonExprConverter.Convert"
},
{
"name": "workerQueryEngine.evaluateComparison"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.10.0",
"status": "unknown",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "0.10.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser and then invoking String or Walk on the resulting AST. Applications that embed the library should reassess the vector for their actual input and privilege boundaries.\u003c/p\u003e"
}
],
"value": "The temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser and then invoking String or Walk on the resulting AST. Applications that embed the library should reassess the vector for their actual input and privilege boundaries."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe known affected Temporal Server lower bound is 0.10.0, based on a source-confirmed built-in filestore visibility-archival query path; earlier Server releases are unknown. Additional source-confirmed SQL and Elasticsearch visibility paths begin in later releases. These routes do not require retained worker state. Their availability depends on the deployed visibility or archival configuration, which CVSS Base scoring assumes is enabled when assessing the vulnerable configuration.\u003c/p\u003e"
}
],
"value": "The known affected Temporal Server lower bound is 0.10.0, based on a source-confirmed built-in filestore visibility-archival query path; earlier Server releases are unknown. Additional source-confirmed SQL and Elasticsearch visibility paths begin in later releases. These routes do not require retained worker state. Their availability depends on the deployed visibility or archival configuration, which CVSS Base scoring assumes is enabled when assessing the vulnerable configuration."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe dynamically confirmed Temporal Server ListWorkers route begins in 1.29.0. In 1.29.x, frontend.ListWorkersEnabled defaults to false; it defaults to true in 1.30.x. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission. The confirmed process-exit route also requires at least one retained worker heartbeat.\u003c/p\u003e"
}
],
"value": "The dynamically confirmed Temporal Server ListWorkers route begins in 1.29.0. In 1.29.x, frontend.ListWorkersEnabled defaults to false; it defaults to true in 1.30.x. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission. The confirmed process-exit route also requires at least one retained worker heartbeat."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003etemporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library\u0027s String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.\u003c/p\u003e"
}
],
"value": "temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library\u0027s String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Denial of service caused by runtime-fatal Go stack exhaustion and process termination. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "temporalio/sqlparser reasonable worst-case network service embedding"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Temporal Server visibility or archival query path in a supported authenticated deployment"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Dynamically confirmed Temporal Server ListWorkers path with retained worker state"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:34:05.930Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "First affected sqlparser source revision",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/commit/1aae9baceee8e48525da8f56b07bf6a5ca7eb147"
},
{
"name": "sqlparser nested-expression fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/6"
},
{
"name": "First fixed sqlparser commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/commit/0466b6b405accfaa781e4bef417933efc18bcaef"
},
{
"name": "Fixed release tag v0.1.0",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
},
{
"name": "Broader sqlparser AST-depth hardening",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/7"
},
{
"name": "Temporal Server dependency update",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11202"
},
{
"name": "Temporal Server 0.10.0 source-confirmed archival route",
"tags": [
"product"
],
"url": "https://github.com/temporalio/temporal/blob/v0.10.0/common/archiver/filestore/queryParser.go#L77-L132"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade github.com/temporalio/sqlparser to v0.0.0-20260721183058-0466b6b405ac or later; v0.0.0-20260722001706-17d16cfe1da5 is the preferred upgrade. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser changes reject excessive nesting before recursive AST consumers receive an attacker-deep tree.\u003c/p\u003e"
}
],
"value": "Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183058-0466b6b405ac or later; v0.0.0-20260722001706-17d16cfe1da5 is the preferred upgrade. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser changes reject excessive nesting before recursive AST consumers receive an attacker-deep tree."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApplications can impose a conservative query-size or nesting limit before parsing and avoid recursively formatting or walking parser-produced trees derived from untrusted input. Temporal Server 1.29 and 1.30 operators can disable ListWorkers when it is unused, disable unused archival reads, and restrict namespace read permission to trusted principals. Go panic recovery is not an effective mitigation for runtime-fatal stack overflow.\u003c/p\u003e"
}
],
"value": "Applications can impose a conservative query-size or nesting limit before parsing and avoid recursively formatting or walking parser-produced trees derived from untrusted input. Temporal Server 1.29 and 1.30 operators can disable ListWorkers when it is unused, disable unused archival reads, and restrict namespace read permission to trusted principals. Go panic recovery is not an effective mitigation for runtime-fatal stack overflow."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-65651",
"datePublished": "2026-09-21T11:34:05.930Z",
"dateReserved": "2026-07-22T18:08:48.925Z",
"dateUpdated": "2026-09-21T15:31:05.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16651 (GCVE-0-2026-16651)
Vulnerability from nvd – Published: 2026-09-21 11:32 – Updated: 2026-09-21 15:32
VLAI
EPSS
VEX
Title
temporalio/sqlparser malformed MySQL version comments can cause a panic
Summary
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:32 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Temporal Technologies, Inc. | temporalio/sqlparser |
Affected:
0.0.0-20180604150908-b055e9c9b4fa , < 0.0.0-20260721183040-74181ffcbaaf
(semver)
|
|
| Temporal Technologies, Inc. | Temporal Server |
Affected:
1.29.0 , ≤ 1.29.7
(semver)
Affected: 1.30.0 , < 1.30.7 (semver) Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:32:17.328992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:32:34.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"modules": [
"Parser"
],
"packageName": "github.com/temporalio/sqlparser",
"product": "temporalio/sqlparser",
"programFiles": [
"comments.go",
"token.go"
],
"programRoutines": [
{
"name": "ExtractMysqlComment"
},
{
"name": "Tokenizer.scanMySQLSpecificComment"
},
{
"name": "Parse"
},
{
"name": "ParseStrictDDL"
},
{
"name": "ParseNext"
}
],
"repo": "https://github.com/temporalio/sqlparser",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.0.0-20260721183040-74181ffcbaaf",
"status": "affected",
"version": "0.0.0-20180604150908-b055e9c9b4fa",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Matching"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"service/matching/handler.go",
"service/matching/workers/worker_query_engine.go"
],
"programRoutines": [
{
"name": "Handler.ListWorkers"
},
{
"name": "getWhereCause"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.29.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries.\u003c/p\u003e"
}
],
"value": "The temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission.\u003c/p\u003e"
}
],
"value": "In Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003etemporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.\u003c/p\u003e"
}
],
"value": "temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Availability degradation or denial of service caused by an uncaught Go runtime panic. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "temporalio/sqlparser reasonable worst-case network service embedding"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Temporal Server ListWorkers in a supported authenticated deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:32:44.699Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "sqlparser fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/5"
},
{
"name": "sqlparser fix commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f"
},
{
"name": "Fixed release tag v0.1.0",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
},
{
"name": "Temporal Server dependency update",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11190"
},
{
"name": "Temporal Server matching-handler panic containment",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11090"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL.\u003c/p\u003e"
}
],
"value": "Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "temporalio/sqlparser malformed MySQL version comments can cause a panic",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix.\u003c/p\u003e"
}
],
"value": "Until upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-16651",
"datePublished": "2026-09-21T11:32:44.699Z",
"dateReserved": "2026-07-22T18:08:54.825Z",
"dateUpdated": "2026-09-21T15:32:34.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65651 (GCVE-0-2026-65651)
Vulnerability from cvelistv5 – Published: 2026-09-21 11:34 – Updated: 2026-09-21 15:31
VLAI
EPSS
VEX
Title
temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
Summary
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:30 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Temporal Technologies, Inc. | temporalio/sqlparser |
Affected:
0.0.0-20141206041240-1aae9baceee8 , < 0.0.0-20260721183058-0466b6b405ac
(semver)
|
|
| Temporal Technologies, Inc. | Temporal Server |
Unknown:
0.0.0 , < 0.10.0
(semver)
Affected: 0.10.0 , ≤ 1.29.7 (semver) Affected: 1.30.0 , < 1.30.7 (semver) Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:30:53.004421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:31:05.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"modules": [
"AST",
"Parser"
],
"packageName": "github.com/temporalio/sqlparser",
"product": "temporalio/sqlparser",
"programFiles": [
"ast.go",
"sql.y"
],
"programRoutines": [
{
"name": "Parse"
},
{
"name": "ParseStrictDDL"
},
{
"name": "ParseNext"
},
{
"name": "String"
},
{
"name": "Walk"
},
{
"name": "UnaryExpr.Format"
}
],
"repo": "https://github.com/temporalio/sqlparser",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.0.0-20260721183058-0466b6b405ac",
"status": "affected",
"version": "0.0.0-20141206041240-1aae9baceee8",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Archival",
"Frontend",
"Matching",
"Visibility"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"common/archiver/filestore/queryParser.go",
"common/persistence/visibility/store/query/converter.go",
"common/persistence/visibility/store/sql/query_converter.go",
"service/matching/workers/worker_query_engine.go"
],
"programRoutines": [
{
"name": "queryParser.convertComparisonExpr"
},
{
"name": "QueryConverter.convertComparisonExpr"
},
{
"name": "comparisonExprConverter.Convert"
},
{
"name": "workerQueryEngine.evaluateComparison"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.10.0",
"status": "unknown",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "0.10.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser and then invoking String or Walk on the resulting AST. Applications that embed the library should reassess the vector for their actual input and privilege boundaries.\u003c/p\u003e"
}
],
"value": "The temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser and then invoking String or Walk on the resulting AST. Applications that embed the library should reassess the vector for their actual input and privilege boundaries."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe known affected Temporal Server lower bound is 0.10.0, based on a source-confirmed built-in filestore visibility-archival query path; earlier Server releases are unknown. Additional source-confirmed SQL and Elasticsearch visibility paths begin in later releases. These routes do not require retained worker state. Their availability depends on the deployed visibility or archival configuration, which CVSS Base scoring assumes is enabled when assessing the vulnerable configuration.\u003c/p\u003e"
}
],
"value": "The known affected Temporal Server lower bound is 0.10.0, based on a source-confirmed built-in filestore visibility-archival query path; earlier Server releases are unknown. Additional source-confirmed SQL and Elasticsearch visibility paths begin in later releases. These routes do not require retained worker state. Their availability depends on the deployed visibility or archival configuration, which CVSS Base scoring assumes is enabled when assessing the vulnerable configuration."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe dynamically confirmed Temporal Server ListWorkers route begins in 1.29.0. In 1.29.x, frontend.ListWorkersEnabled defaults to false; it defaults to true in 1.30.x. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission. The confirmed process-exit route also requires at least one retained worker heartbeat.\u003c/p\u003e"
}
],
"value": "The dynamically confirmed Temporal Server ListWorkers route begins in 1.29.0. In 1.29.x, frontend.ListWorkersEnabled defaults to false; it defaults to true in 1.30.x. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission. The confirmed process-exit route also requires at least one retained worker heartbeat."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003etemporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library\u0027s String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.\u003c/p\u003e"
}
],
"value": "temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library\u0027s String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Denial of service caused by runtime-fatal Go stack exhaustion and process termination. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "temporalio/sqlparser reasonable worst-case network service embedding"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Temporal Server visibility or archival query path in a supported authenticated deployment"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Dynamically confirmed Temporal Server ListWorkers path with retained worker state"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:34:05.930Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "First affected sqlparser source revision",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/commit/1aae9baceee8e48525da8f56b07bf6a5ca7eb147"
},
{
"name": "sqlparser nested-expression fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/6"
},
{
"name": "First fixed sqlparser commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/commit/0466b6b405accfaa781e4bef417933efc18bcaef"
},
{
"name": "Fixed release tag v0.1.0",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
},
{
"name": "Broader sqlparser AST-depth hardening",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/7"
},
{
"name": "Temporal Server dependency update",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11202"
},
{
"name": "Temporal Server 0.10.0 source-confirmed archival route",
"tags": [
"product"
],
"url": "https://github.com/temporalio/temporal/blob/v0.10.0/common/archiver/filestore/queryParser.go#L77-L132"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade github.com/temporalio/sqlparser to v0.0.0-20260721183058-0466b6b405ac or later; v0.0.0-20260722001706-17d16cfe1da5 is the preferred upgrade. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser changes reject excessive nesting before recursive AST consumers receive an attacker-deep tree.\u003c/p\u003e"
}
],
"value": "Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183058-0466b6b405ac or later; v0.0.0-20260722001706-17d16cfe1da5 is the preferred upgrade. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser changes reject excessive nesting before recursive AST consumers receive an attacker-deep tree."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApplications can impose a conservative query-size or nesting limit before parsing and avoid recursively formatting or walking parser-produced trees derived from untrusted input. Temporal Server 1.29 and 1.30 operators can disable ListWorkers when it is unused, disable unused archival reads, and restrict namespace read permission to trusted principals. Go panic recovery is not an effective mitigation for runtime-fatal stack overflow.\u003c/p\u003e"
}
],
"value": "Applications can impose a conservative query-size or nesting limit before parsing and avoid recursively formatting or walking parser-produced trees derived from untrusted input. Temporal Server 1.29 and 1.30 operators can disable ListWorkers when it is unused, disable unused archival reads, and restrict namespace read permission to trusted principals. Go panic recovery is not an effective mitigation for runtime-fatal stack overflow."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-65651",
"datePublished": "2026-09-21T11:34:05.930Z",
"dateReserved": "2026-07-22T18:08:48.925Z",
"dateUpdated": "2026-09-21T15:31:05.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16651 (GCVE-0-2026-16651)
Vulnerability from cvelistv5 – Published: 2026-09-21 11:32 – Updated: 2026-09-21 15:32
VLAI
EPSS
VEX
Title
temporalio/sqlparser malformed MySQL version comments can cause a panic
Summary
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:32 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Temporal Technologies, Inc. | temporalio/sqlparser |
Affected:
0.0.0-20180604150908-b055e9c9b4fa , < 0.0.0-20260721183040-74181ffcbaaf
(semver)
|
|
| Temporal Technologies, Inc. | Temporal Server |
Affected:
1.29.0 , ≤ 1.29.7
(semver)
Affected: 1.30.0 , < 1.30.7 (semver) Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:32:17.328992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:32:34.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"modules": [
"Parser"
],
"packageName": "github.com/temporalio/sqlparser",
"product": "temporalio/sqlparser",
"programFiles": [
"comments.go",
"token.go"
],
"programRoutines": [
{
"name": "ExtractMysqlComment"
},
{
"name": "Tokenizer.scanMySQLSpecificComment"
},
{
"name": "Parse"
},
{
"name": "ParseStrictDDL"
},
{
"name": "ParseNext"
}
],
"repo": "https://github.com/temporalio/sqlparser",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.0.0-20260721183040-74181ffcbaaf",
"status": "affected",
"version": "0.0.0-20180604150908-b055e9c9b4fa",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Matching"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"service/matching/handler.go",
"service/matching/workers/worker_query_engine.go"
],
"programRoutines": [
{
"name": "Handler.ListWorkers"
},
{
"name": "getWhereCause"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.29.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries.\u003c/p\u003e"
}
],
"value": "The temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission.\u003c/p\u003e"
}
],
"value": "In Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003etemporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.\u003c/p\u003e"
}
],
"value": "temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Availability degradation or denial of service caused by an uncaught Go runtime panic. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "temporalio/sqlparser reasonable worst-case network service embedding"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Temporal Server ListWorkers in a supported authenticated deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:32:44.699Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "sqlparser fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/5"
},
{
"name": "sqlparser fix commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f"
},
{
"name": "Fixed release tag v0.1.0",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
},
{
"name": "Temporal Server dependency update",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11190"
},
{
"name": "Temporal Server matching-handler panic containment",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11090"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL.\u003c/p\u003e"
}
],
"value": "Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "temporalio/sqlparser malformed MySQL version comments can cause a panic",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix.\u003c/p\u003e"
}
],
"value": "Until upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-16651",
"datePublished": "2026-09-21T11:32:44.699Z",
"dateReserved": "2026-07-22T18:08:54.825Z",
"dateUpdated": "2026-09-21T15:32:34.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}