CVE-2026-16651
temporalio/sqlparser malformed MySQL version comments can cause a panic
- Published
- Updated
- Reserved
- Assigned by
- Temporal
Description
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Timeline
ID reserved
By Temporal
- 2 months later
· 2 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| TemporalCNA (assigner) | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| TemporalCNA (assigner) | 4.0 | High7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| NVDNVD · Awaiting Analysis | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Weakness
Affected products
Temporal Technologies, Inc. · temporalio/sqlparser
- affected 0.0.0-20180604150908-b055e9c9b4fa – < 0.0.0-20260721183040-74181ffcbaaf
Temporal Technologies, Inc. · Temporal Server
- affected 1.29.0 – ≤ 1.29.7
- affected 1.30.0 – < 1.30.7
- affected 1.31.0 – < 1.31.3
What to do
Solution: Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183040-74181ffcbaaf or later. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser fix treats MySQL version comments as ordinary comments instead of interpreting their contents as SQL.
Workaround: Until upgrading, applications can reject MySQL version comments before invoking the parser or recover parser panics on the parsing goroutine. Temporal Server 1.29 and 1.30 operators can set frontend.ListWorkersEnabled to false. On any affected Server release, restrict ListWorkers to trusted principals or apply the matching-handler panic-recovery change as interim containment. Panic recovery does not replace the parser fix.
References (7)
- sqlparser fix pull request (opens in a new tab)patch
- sqlparser fix commit (opens in a new tab)patch
- Fixed release tag v0.1.0 (opens in a new tab)product
- Temporal Server dependency update (opens in a new tab)patch
- Temporal Server matching-handler panic containment (opens in a new tab)patch
- Temporal Server 1.30.7 (opens in a new tab)release-notes
- Temporal Server 1.31.3 (opens in a new tab)release-notes
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-16651)Record last updated .