CVE-2026-65651

Name of the Vulnerable Software and Affected Versions temporalio/sqlparser (affected versions not specified) Temporal Server (affected versions not specified)

Description The temporalio/sqlparser library allows SQL containing deeply nested unary expressions, resulting in a deep abstract syntax tree because no nesting limit is enforced. The String and Walk operations recursively traverse this tree. When an application parses attacker-controlled SQL and subsequently formats or walks the tree, it can trigger a runtime-fatal Go stack overflow, which terminates the process and cannot be handled by Go panic recovery. Temporal Server is affected as it passes caller-controlled query input through this parser in archival, visibility, and worker-query paths. Specifically, in validation paths, the Server recursively formats invalid expressions during error construction. An authenticated user with namespace read permission can terminate the Frontend or Matching process. The ListWorkers route also requires at least one retained worker heartbeat. This can lead to a sustained denial of service affecting availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.