CVE-2026-16651

temporalio/sqlparser malformed MySQL version comments can cause a panic

CVSS 4.0 8.7 HIGHCVSS 4.0 7.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-16651

Published

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-16651

Published

github.com/temporalio/sqlparser

https://pkg.go.dev

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "temporalio/sqlparser",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "github.com/temporalio/sqlparser",
                    "repo": "https://github.com/temporalio/sqlparser",
                    "modules": [
                        "Parser"
                    ],
                    "programFiles": [
                        "comments.go",
                        "token.go"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.0.0-20180604150908-b055e9c9b4fa",
                            "lessThan": "0.0.0-20260721183040-74181ffcbaaf",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "programRoutines": [
                        {
                            "name": "ExtractMysqlComment"
                        },
                        {
                            "name": "Tokenizer.scanMySQLSpecificComment"
                        },
                        {
                            "name": "Parse"
                        },
                        {
                            "name": "ParseStrictDDL"
                        },
                        {
                            "name": "ParseNext"
                        }
                    ]
                }

go.temporal.io/server

https://pkg.go.dev

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "Temporal Server",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "go.temporal.io/server",
                    "repo": "https://github.com/temporalio/temporal",
                    "modules": [
                        "Matching"
                    ],
                    "programFiles": [
                        "service/matching/handler.go",
                        "service/matching/workers/worker_query_engine.go"
                    ],
                    "programRoutines": [
                        {
                            "name": "Handler.ListWorkers"
                        },
                        {
                            "name": "getWhereCause"
                        }
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.29.0",
                            "lessThanOrEqual": "1.29.7",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.30.0",
                            "lessThan": "1.30.7",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.31.0",
                            "lessThan": "1.31.3",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON