temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
Summary
| CVE | CVE-2026-65651 |
|---|---|
| State | PUBLISHED |
| Assigner | Temporal |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-21 12:17:15 UTC |
| Updated | 2026-09-21 16:17:10 UTC |
| Description | temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-674 | CWE-674 CWE-674: Uncontrolled Recursion
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 4.0 | CNA | CVSS | 7.1 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 4.0 | CNA | CVSS | 6 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Temporal Technologies Inc. | Temporalio/sqlparser | affected 0.0.0-20141206041240-1aae9baceee8 0.0.0-20260721183058-0466b6b405ac semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | unknown 0.0.0 0.10.0 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 0.10.0 1.29.7 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.30.0 1.30.7 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.31.0 1.31.3 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/temporalio/sqlparser/commit/0466b6b405accfaa781e4bef417933efc... | [email protected] | github.com | |
| github.com/temporalio/sqlparser/tree/v0.1.0 | [email protected] | github.com | |
| github.com/temporalio/temporal/releases/tag/v1.31.3 | [email protected] | github.com | |
| github.com/temporalio/sqlparser/pull/7 | [email protected] | github.com | |
| github.com/temporalio/sqlparser/commit/1aae9baceee8e48525da8f56b07bf6a5c... | [email protected] | github.com | |
| github.com/temporalio/temporal/blob/v0.10.0/common/archiver/filestore/qu... | [email protected] | github.com | |
| github.com/temporalio/sqlparser/pull/6 | [email protected] | github.com | |
| github.com/temporalio/temporal/releases/tag/v1.30.7 | [email protected] | github.com | |
| github.com/temporalio/temporal/pull/11202 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: An external security researcher who reported this issue responsibly to Temporal Technologies (en)
Additional Advisory Data
Solutions
CNA: Upgrade github.com/temporalio/sqlparser to v0.0.0-20260721183058-0466b6b405ac or later; v0.0.0-20260722001706-17d16cfe1da5 is the preferred upgrade. Temporal Server operators should upgrade to 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line. The parser changes reject excessive nesting before recursive AST consumers receive an attacker-deep tree.
Workarounds
CNA: Applications can impose a conservative query-size or nesting limit before parsing and avoid recursively formatting or walking parser-produced trees derived from untrusted input. Temporal Server 1.29 and 1.30 operators can disable ListWorkers when it is unused, disable unused archival reads, and restrict namespace read permission to trusted principals. Go panic recovery is not an effective mitigation for runtime-fatal stack overflow.