FKIE_CVE-2026-65651

Vulnerability from fkie_nvd - Published: 2026-09-21 12:17 - Updated: 2026-09-22 19:40
Severity
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
References
security@temporal.iohttps://github.com/temporalio/sqlparser/commit/0466b6b405accfaa781e4bef417933efc18bcaef
security@temporal.iohttps://github.com/temporalio/sqlparser/commit/1aae9baceee8e48525da8f56b07bf6a5ca7eb147
security@temporal.iohttps://github.com/temporalio/sqlparser/pull/6
security@temporal.iohttps://github.com/temporalio/sqlparser/pull/7
security@temporal.iohttps://github.com/temporalio/sqlparser/tree/v0.1.0
security@temporal.iohttps://github.com/temporalio/temporal/blob/v0.10.0/common/archiver/filestore/queryParser.go#L77-L132
security@temporal.iohttps://github.com/temporalio/temporal/pull/11202
security@temporal.iohttps://github.com/temporalio/temporal/releases/tag/v1.30.7
security@temporal.iohttps://github.com/temporalio/temporal/releases/tag/v1.31.3
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "modules": [
            "AST",
            "Parser"
          ],
          "packageName": "github.com/temporalio/sqlparser",
          "product": "temporalio/sqlparser",
          "programFiles": [
            "ast.go",
            "sql.y"
          ],
          "programRoutines": [
            {
              "name": "Parse"
            },
            {
              "name": "ParseStrictDDL"
            },
            {
              "name": "ParseNext"
            },
            {
              "name": "String"
            },
            {
              "name": "Walk"
            },
            {
              "name": "UnaryExpr.Format"
            }
          ],
          "repo": "https://github.com/temporalio/sqlparser",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThan": "0.0.0-20260721183058-0466b6b405ac",
              "status": "affected",
              "version": "0.0.0-20141206041240-1aae9baceee8",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "cpes": [
            "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Archival",
            "Frontend",
            "Matching",
            "Visibility"
          ],
          "packageName": "go.temporal.io/server",
          "product": "Temporal Server",
          "programFiles": [
            "common/archiver/filestore/queryParser.go",
            "common/persistence/visibility/store/query/converter.go",
            "common/persistence/visibility/store/sql/query_converter.go",
            "service/matching/workers/worker_query_engine.go"
          ],
          "programRoutines": [
            {
              "name": "queryParser.convertComparisonExpr"
            },
            {
              "name": "QueryConverter.convertComparisonExpr"
            },
            {
              "name": "comparisonExprConverter.Convert"
            },
            {
              "name": "workerQueryEngine.evaluateComparison"
            }
          ],
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThan": "0.10.0",
              "status": "unknown",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.29.7",
              "status": "affected",
              "version": "0.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.30.7",
              "status": "affected",
              "version": "1.30.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.31.3",
              "status": "affected",
              "version": "1.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@temporal.io"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library\u0027s String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified."
    }
  ],
  "id": "CVE-2026-65651",
  "lastModified": "2026-09-22T19:40:05.870",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@temporal.io",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-65651",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-21T15:30:53.004421Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-21T12:17:15.553",
  "references": [
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/sqlparser/commit/0466b6b405accfaa781e4bef417933efc18bcaef"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/sqlparser/commit/1aae9baceee8e48525da8f56b07bf6a5ca7eb147"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/sqlparser/pull/6"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/sqlparser/pull/7"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/sqlparser/tree/v0.1.0"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/temporal/blob/v0.10.0/common/archiver/filestore/queryParser.go#L77-L132"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/temporal/pull/11202"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
    },
    {
      "source": "security@temporal.io",
      "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
    }
  ],
  "sourceIdentifier": "security@temporal.io",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "security@temporal.io",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.