Temporal sqlparser SQL Parser stack-based overflow

Summaryinfo

A vulnerability was found in Temporal sqlparser and classified as problematic. Affected by this issue is some unknown functionality of the component SQL Parser. The manipulation results in stack-based overflow. This vulnerability is known as CVE-2026-65651. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Temporal sqlparser (the affected version is unknown). Affected is an unknown code of the component SQL Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on availability. CVE summarizes:

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-65651 since 07/22/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available.

Applying the patch 1aae9baceee8e48525da8f56b07bf6a5ca7eb147 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Temporal

Name

• sqlparser

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion