temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.
Summary
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Temporal Technologies, Inc. | temporalio/sqlparser | 0.0.0-20141206041240-1aae9baceee8 to before 0.0.0-20260721183058-0466b6b405ac | 0.0.0-20260721183058-0466b6b405ac | Patch available | CNA |
| Temporal Technologies, Inc. | Temporal Server | 0.10.0 – 1.29.7; 1.30.0 to before 1.30.7; 1.31.0 to before 1.31.3 | 1.30.7, 1.31.3 | Patch available | CNA |
- temporalio/sqlparser VendorTemporal Technologies, Inc. Affected 0.0.0-20141206041240-1aae9baceee8 to before 0.0.0-20260721183058-0466b6b405ac Fixed in 0.0.0-20260721183058-0466b6b405ac Patch available CNA
- Temporal Server VendorTemporal Technologies, Inc. Affected 0.10.0 – 1.29.7; 1.30.0 to before 1.30.7; 1.31.0 to before 1.31.3 Fixed in 1.30.7, 1.31.3 Patch available CNA
Remediation
- Fix · CNA temporalio/sqlparser (Temporal Technologies, Inc.) Fixed in 0.0.0-20260721183058-0466b6b405ac
- Fix · CNA Temporal Server (Temporal Technologies, Inc.) Fixed in 1.30.7, 1.31.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-65651
- 2026-10-03 Alias added: GHSA-7vcf-7m3r-v7x3
References
Patch 4
More Temporal Technologies, Inc. vulnerabilities
- TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
- TI-2026-46800 temporalio/tchannel-go zero-chunk call fragment causes process termination CVSS 4.0HIGH 8.7
- TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
- TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
- TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
- TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7
Sources
- CVE-2026-65651 · CVE Program
- CVE-2026-65651 · NVD
- FIRST EPSS
- GHSA-7vcf-7m3r-v7x3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences