CVE-2026-65651

temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

CVSS 4.0 8.7 HIGHCVSS 4.0 7.1 HIGHCVSS 4.0 6.0 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-65651

Published

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-65651

Published

github.com/temporalio/sqlparser

https://pkg.go.dev

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "temporalio/sqlparser",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "github.com/temporalio/sqlparser",
                    "repo": "https://github.com/temporalio/sqlparser",
                    "modules": [
                        "AST",
                        "Parser"
                    ],
                    "programFiles": [
                        "ast.go",
                        "sql.y"
                    ],
                    "programRoutines": [
                        {
                            "name": "Parse"
                        },
                        {
                            "name": "ParseStrictDDL"
                        },
                        {
                            "name": "ParseNext"
                        },
                        {
                            "name": "String"
                        },
                        {
                            "name": "Walk"
                        },
                        {
                            "name": "UnaryExpr.Format"
                        }
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.0.0-20141206041240-1aae9baceee8",
                            "lessThan": "0.0.0-20260721183058-0466b6b405ac",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

go.temporal.io/server

https://pkg.go.dev

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "Temporal Server",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "go.temporal.io/server",
                    "repo": "https://github.com/temporalio/temporal",
                    "modules": [
                        "Archival",
                        "Frontend",
                        "Matching",
                        "Visibility"
                    ],
                    "programFiles": [
                        "common/archiver/filestore/queryParser.go",
                        "common/persistence/visibility/store/query/converter.go",
                        "common/persistence/visibility/store/sql/query_converter.go",
                        "service/matching/workers/worker_query_engine.go"
                    ],
                    "programRoutines": [
                        {
                            "name": "queryParser.convertComparisonExpr"
                        },
                        {
                            "name": "QueryConverter.convertComparisonExpr"
                        },
                        {
                            "name": "comparisonExprConverter.Convert"
                        },
                        {
                            "name": "workerQueryEngine.evaluateComparison"
                        }
                    ],
                    "versions": [
                        {
                            "status": "unknown",
                            "version": "0.0.0",
                            "lessThan": "0.10.0",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "0.10.0",
                            "lessThanOrEqual": "1.29.7",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.30.0",
                            "lessThan": "1.30.7",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "1.31.0",
                            "lessThan": "1.31.3",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON