Vulnerability · Published Sep 21, 2026 · Assigned by Temporal
CVE-2026-16651temporalio/sqlparser malformed MySQL version comments can cause a panic
High 8.7
In plain English
A high-severity security flaw in Temporal Server from Temporal Technologies, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Temporal Technologies, Inc. | temporalio/sqlparser | 0.0.0-20180604150908-b055e9c9b4fa – before 0.0.0-20260721183040-74181ffcbaaf |
| Temporal Technologies, Inc. | Temporal Server | 1.29.0 – through 1.29.71.30.0 – before 1.30.71.31.0 – before 1.31.3 |
Weakness: CWE-129 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- sqlparser fix pull request patch
- sqlparser fix commit patch
- Fixed release tag v0.1.0 product
- Temporal Server dependency update patch
- Temporal Server matching-handler panic containment patch
- Temporal Server 1.30.7 release-notes
- Temporal Server 1.31.3 release-notes