CVE-2026-16651

HighCVSS 8.7

Published: 21/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 21/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

33th percentile - higher than 33% of all known CVEs

Summary

The temporalio/sqlparser library can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary, causing a Go runtime panic that terminates the process.

Risk Assessment

An authenticated caller with namespace read permission can submit a malformed query through the ListWorkers API and terminate the Matching process, causing a denial of service. Repeated requests can sustain the attack.

Recommendation

Update temporalio/sqlparser and Temporal Server to a version containing the MySQL comment validation fix. Consider disabling the ListWorkers API if it is not required.

Other vulnerabilities in temporalio/sqlparser

CVE-2026-65651High
The temporalio/sqlparser library accepts SQL containing deeply nested unary expressions and returns a correspondingly deep abstract syntax tree without enforcing a nesting limit. Its String and Walk operations recursively traverse that tree, which can cause a runtime-fatal Go stack overflow that terminates the process. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths.

Original NVD description (English source)

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS