rewindex

RewindexCVEsTemporal Cloud

CVE-2026-65651: temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

High · CVSS 8.7 (CVSS 4.0)EPSS 0.67%, 52th percentilePublished Updated Assigner: Temporal

Description

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

CWE-674

Tracked companies

Temporal Cloud

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Temporal Technologies, Inc.: temporalio/sqlparserTemporal Technologies, Inc.: Temporal Server

References

All CVEsMarkdownJSON