Temporal sqlparser MySQL Comment Parsing ExtractMysqlComment denial of service

Summaryinfo

A vulnerability identified as problematic has been detected in Temporal sqlparser. The affected element is the function ExtractMysqlComment of the component MySQL Comment Parsing. The manipulation leads to denial of service. This vulnerability is referenced as CVE-2026-16651. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Temporal sqlparser (affected version not known). It has been rated as problematic. This issue affects the function ExtractMysqlComment of the component MySQL Comment Parsing. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-16651 since 07/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Applying the patch 5 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Temporal

Name

• sqlparser

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion