CVE-2026-65651
Received Received - Intake

Temporal Server Stack Overflow via Deeply Nested SQL Parsing

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Temporal Technologies Inc.

Description
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-65651
EUVD
EUVD-2026-83892

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
temporalio sqlparser From 0.1.0 (inc)
temporalio sqlparser *
temporalio temporal 1.30.7
temporalio temporal 1.31.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a stack overflow in the temporalio/sqlparser library caused by deeply nested unary expressions in SQL queries. The parser creates an abstract syntax tree (AST) without enforcing a nesting limit, and recursive operations like String or Walk traverse this deep tree, leading to a fatal Go stack overflow. The Temporal Server uses this parser in archival, visibility, and worker-query paths, allowing authenticated users with namespace read permission to terminate Frontend or Matching processes via crafted queries.

Detection Guidance

Detecting this vulnerability requires checking if your Temporal Server version is affected. Use commands like 'temporal server version' or inspect deployment manifests for versions before 1.30.7. Monitor for process crashes when parsing SQL queries with deeply nested expressions.

Impact Analysis

An attacker with namespace read permission could send malicious SQL queries to crash Temporal Server processes, causing a denial of service. Repeated exploitation could sustain the outage. The impact is limited to availability; no data confidentiality or integrity loss was identified.

Compliance Impact

This vulnerability primarily affects system availability by allowing attackers to terminate processes via stack overflow. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged denial of service could indirectly affect compliance by disrupting access to personal or health data processing systems.

Mitigation Strategies

Upgrade Temporal Server to version 1.30.7 or later. Update the sqlparser dependency to a version implementing depth limits (e.g., v0.1.0+ with PR #6/#8 applied). Restart services to apply changes and monitor for crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65651. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart