CVE-2026-16651 (GCVE-0-2026-16651)
Vulnerability from cvelistv5 – Published: 2026-09-21 11:32 – Updated: 2026-09-21 15:32
VLAI
EPSS
VEX
Title
temporalio/sqlparser malformed MySQL version comments can cause a panic
Summary
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:32 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Temporal Technologies, Inc. | temporalio/sqlparser |
Affected:
0.0.0-20180604150908-b055e9c9b4fa , < 0.0.0-20260721183040-74181ffcbaaf
(semver)
|
guessed | |
| Temporal Technologies, Inc. | Temporal Server |
Affected:
1.29.0 , ≤ 1.29.7
(semver)
Affected: 1.30.0 , < 1.30.7 (semver) Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:32:17.328992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:32:34.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"modules": [
"Parser"
],
"packageName": "github.com/temporalio/sqlparser",
"product": "temporalio/sqlparser",
"programFiles": [
"comments.go",
"token.go"
],
"programRoutines": [
{
"name": "ExtractMysqlComment"
},
{
"name": "Tokenizer.scanMySQLSpecificComment"
},
{
"name": "Parse"
},
{
"name": "ParseStrictDDL"
},
{
"name": "ParseNext"
}
],
"repo": "https://github.com/temporalio/sqlparser",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.0.0-20260721183040-74181ffcbaaf",
"status": "affected",
"version": "0.0.0-20180604150908-b055e9c9b4fa",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Matching"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"service/matching/handler.go",
"service/matching/workers/worker_query_engine.go"
],
"programRoutines": [
{
"name": "Handler.ListWorkers"
},
{
"name": "getWhereCause"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.29.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries.\u003c/p\u003e"
}
],
"value": "The temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission.\u003c/p\u003e"
}
],
"value": "In Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003etemporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.\u003c/p\u003e"
}
],
"value": "temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Availability degradation or denial of service caused by an uncaught Go runtime panic. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "temporalio/sqlparser reasonable worst-case network service embedding"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Temporal Server ListWorkers in a supported authenticated deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:32:44.699Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "sqlparser fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/5"
},
{
"name": "sqlparser fix commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f"
},
{
"name": "Fixed release tag v0.1.0",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
},
{
"name": "Temporal Server dependency update",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11190"
},
{
"name": "Temporal Server matching-handler panic containment",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11090"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL.\u003c/p\u003e"
}
],
"value": "Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "temporalio/sqlparser malformed MySQL version comments can cause a panic",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix.\u003c/p\u003e"
}
],
"value": "Until upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-16651",
"datePublished": "2026-09-21T11:32:44.699Z",
"dateReserved": "2026-07-22T18:08:54.825Z",
"dateUpdated": "2026-09-21T15:32:34.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"modules": [
"Parser"
],
"packageName": "github.com/temporalio/sqlparser",
"product": "temporalio/sqlparser",
"programFiles": [
"comments.go",
"token.go"
],
"programRoutines": [
{
"name": "ExtractMysqlComment"
},
{
"name": "Tokenizer.scanMySQLSpecificComment"
},
{
"name": "Parse"
},
{
"name": "ParseStrictDDL"
},
{
"name": "ParseNext"
}
],
"repo": "https://github.com/temporalio/sqlparser",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.0.0-20260721183040-74181ffcbaaf",
"status": "affected",
"version": "0.0.0-20180604150908-b055e9c9b4fa",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Matching"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"service/matching/handler.go",
"service/matching/workers/worker_query_engine.go"
],
"programRoutines": [
{
"name": "Handler.ListWorkers"
},
{
"name": "getWhereCause"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.29.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"source": "security@temporal.io"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
}
],
"id": "CVE-2026-16651",
"lastModified": "2026-09-21T16:17:07.067",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security@temporal.io",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-16651",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:32:17.328992Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-21T12:17:10.167",
"references": [
{
"source": "security@temporal.io",
"url": "https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f"
},
{
"source": "security@temporal.io",
"url": "https://github.com/temporalio/sqlparser/pull/5"
},
{
"source": "security@temporal.io",
"url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
},
{
"source": "security@temporal.io",
"url": "https://github.com/temporalio/temporal/pull/11090"
},
{
"source": "security@temporal.io",
"url": "https://github.com/temporalio/temporal/pull/11190"
},
{
"source": "security@temporal.io",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"source": "security@temporal.io",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"sourceIdentifier": "security@temporal.io",
"vulnStatus": "Received",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-129"
}
],
"source": "security@temporal.io",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:32:17.328992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:32:29.015Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"modules": [
"Parser"
],
"packageName": "github.com/temporalio/sqlparser",
"product": "temporalio/sqlparser",
"programFiles": [
"comments.go",
"token.go"
],
"programRoutines": [
{
"name": "ExtractMysqlComment"
},
{
"name": "Tokenizer.scanMySQLSpecificComment"
},
{
"name": "Parse"
},
{
"name": "ParseStrictDDL"
},
{
"name": "ParseNext"
}
],
"repo": "https://github.com/temporalio/sqlparser",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "0.0.0-20260721183040-74181ffcbaaf",
"status": "affected",
"version": "0.0.0-20180604150908-b055e9c9b4fa",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Matching"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"service/matching/handler.go",
"service/matching/workers/worker_query_engine.go"
],
"programRoutines": [
{
"name": "Handler.ListWorkers"
},
{
"name": "getWhereCause"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.29.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries.\u003c/p\u003e"
}
],
"value": "The temporalio/sqlparser CVSS scenario uses the reasonable worst case of a network service passing unauthenticated attacker-controlled SQL to the parser without same-goroutine panic recovery. Applications that embed the library should reassess the vector for their actual input, privilege, and recovery boundaries."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission.\u003c/p\u003e"
}
],
"value": "In Temporal Server 1.29.x, ListWorkers reaches the vulnerable parser only when frontend.ListWorkersEnabled is enabled; the setting defaults to false. In 1.30.x, the setting defaults to true. Beginning in 1.31.0, the setting remains defined but is no longer honored, and ListWorkers is always enabled. In supported authenticated deployments, ListWorkers requires namespace read permission."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003etemporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.\u003c/p\u003e"
}
],
"value": "temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Availability degradation or denial of service caused by an uncaught Go runtime panic. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "temporalio/sqlparser reasonable worst-case network service embedding"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Temporal Server ListWorkers in a supported authenticated deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:32:44.699Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "sqlparser fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/pull/5"
},
{
"name": "sqlparser fix commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f"
},
{
"name": "Fixed release tag v0.1.0",
"tags": [
"product"
],
"url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
},
{
"name": "Temporal Server dependency update",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11190"
},
{
"name": "Temporal Server matching-handler panic containment",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11090"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL.\u003c/p\u003e"
}
],
"value": "Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "temporalio/sqlparser malformed MySQL version comments can cause a panic",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix.\u003c/p\u003e"
}
],
"value": "Until upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-16651",
"datePublished": "2026-09-21T11:32:44.699Z",
"dateReserved": "2026-07-22T18:08:54.825Z",
"dateUpdated": "2026-09-21T15:32:34.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…