CVE-2026-16651: temporalio/sqlparser malformed MySQL version comments can cause a panic
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
github.com/temporalio/sqlparserto a version that resolves this vulnerability.Fixed in v0.0.0-20260721183040-74181ffcbaaf - Upgrade
Upgrade
Temporal Serverto a version that resolves this vulnerability.Fixed in 1.30.7 - Upgrade
Upgrade
Temporal Serverto a version that resolves this vulnerability.Fixed in 1.31.3 - Upgrade
Upgrade
Temporal Serverto a version that resolves this vulnerability.Fixed in 1.32.0
Event History
Frequently Asked Questions
Who can exploit this through Temporal Server?
The ListWorkers API must be enabled, and the caller must be authenticated with namespace read permission. Such a caller can submit a malformed query that terminates the receiving Matching process.
Are applications affected only when they use Temporal Server?
No. Any application that passes attacker-controlled SQL to Parse, ParseStrictDDL, or ParseNext can be affected if the panic is not recovered on the parsing goroutine.
What input triggers the failure?
A MySQL version comment whose contents are empty or contain only one to five decimal digits triggers the panic condition.
What can be done if patching is not immediately possible?
Avoid parsing untrusted SQL with the affected functions, or ensure the parsing goroutine recovers from panics. For Temporal Server, disabling ListWorkers removes the described API exposure.
How can an organization determine whether it has been affected?
Look for Go runtime panics and termination of Matching processes associated with ListWorkers requests containing malformed MySQL version comments. Repeated malformed requests may produce recurring process terminations and availability disruption.