CVE-2026-16651: Temporal SQL Parser DOS Vulnerability

CVE-2026-16651 Overview

CVE-2026-16651 is a denial of service vulnerability in the temporalio/sqlparser Go library. The parser panics when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. The ExtractMysqlComment function does not validate the -1 sentinel returned by strings.IndexFunc before using it as a slice boundary, triggering a Go runtime panic. Temporal Server exposes the affected parser through the ListWorkers API. An authenticated caller with namespace read permission can submit malformed SQL that terminates the receiving Matching process. Repeated requests sustain the denial of service condition.

Critical Impact
An authenticated attacker with namespace read permission can repeatedly crash Temporal Matching processes by submitting malformed MySQL version comments through the ListWorkers API.

Affected Products

temporalio/sqlparser prior to v0.1.0
Temporal Server versions prior to v1.30.7
Temporal Server versions prior to v1.31.3

Discovery Timeline

2026-09-21 - CVE-2026-16651 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-16651

Vulnerability Analysis

The vulnerability is classified under [CWE-129] Improper Validation of Array Index. The ExtractMysqlComment function in comments.go handles MySQL executable comments of the form /*!50700 ... */, which specify a minimum server version. When parsing these comments, the function calls strings.IndexFunc to locate the boundary between the version digits and the comment body. Go's strings.IndexFunc returns -1 when no matching character is found. The function uses this return value directly as a slice index without validating it. When the comment body is empty or contains only one to five decimal digits with no trailing non-digit character, the negative index triggers a runtime panic that unwinds the parsing goroutine.

Because the panic originates on the parser goroutine, callers that do not install a recover handler propagate the panic upward. In Temporal Server, this terminates the receiving Matching process. The impact is limited to availability; no data confidentiality or integrity is affected.

Root Cause

The root cause is missing bounds checking on the result of strings.IndexFunc before the value is used as a slice boundary. Additionally, the parser accepted MySQL-specific executable comment syntax that has no legitimate use in Temporal query workloads, expanding the attack surface unnecessarily.

Attack Vector

An authenticated user holding namespace read permission calls the ListWorkers API on a Temporal Server deployment where the API is enabled. The user supplies a query string containing a crafted comment such as /*!*/ or /*!50700*/. The Matching service parses the query, invokes ExtractMysqlComment, and panics. Repeated invocations sustain a denial of service against the affected process.

// Security patch in comments.go - Remove parsing MySQL special comments (#5)
// Source: https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f

			if index <= 1 {
				return sql
			}
-			// don't strip /*! ... */ or /*!50700 ... */
-			if len(sql) > 2 && sql[2] == '!' {
-				return sql
-			}
			sql = sql[index+2:]
		case '-':
			// Single line comment

The patch removes the special-case handling that preserved MySQL executable comments, so the vulnerable code path is no longer reachable during comment stripping. A companion change in analyzer.go removes the now-unused StmtComment classification.

Detection Methods for CVE-2026-16651

Indicators of Compromise

Unexpected crash-and-restart cycles of Temporal Matching service processes without accompanying resource exhaustion or OOM signals.
Authenticated ListWorkers API requests containing query strings with MySQL executable comments such as /*!*/, /*!0*/, or /*!99999*/.
Repeated runtime error: slice bounds out of range panics attributed to ExtractMysqlComment in Temporal server logs.

Detection Strategies

Inspect API access logs for ListWorkers calls where the query parameter contains the substring /*! followed by zero to five digits and an immediate */.
Correlate spikes in Matching service restarts with the identity of authenticated principals issuing ListWorkers requests in the same window.
Alert on Go panic stack traces in Temporal logs that reference sqlparser.ExtractMysqlComment or sqlparser.Parse.

Monitoring Recommendations

Track process uptime and restart counters for Temporal Matching, History, and Frontend services.
Enable request-body logging on the Frontend service for ListWorkers calls, redacting non-query fields, and forward logs to a centralized analytics platform.
Baseline the volume of ListWorkers calls per namespace and per principal, then alert on sudden deviations that coincide with service restarts.

How to Mitigate CVE-2026-16651

Immediate Actions Required

Upgrade Temporal Server to v1.30.7 or v1.31.3 (or later) on all Frontend, Matching, and History nodes.
Update the temporalio/sqlparser dependency to v0.1.0 or later in any downstream Go application that embeds the parser.
Audit namespace read permissions and revoke ListWorkers access from principals that do not require it.

Patch Information

The upstream fix is delivered in GitHub Commit 74181ff and merged via GitHub Pull Request #5, tagged as sqlparser v0.1.0. Temporal Server integrates the fix through Pull Request #11090 and Pull Request #11190, released as Temporal Server v1.30.7 and v1.31.3.

Workarounds

Disable the ListWorkers API on the Frontend service if it is not required by workflow operators.
Restrict network access to Temporal Frontend endpoints so that only trusted internal callers can reach the ListWorkers handler.
For applications that embed the parser and cannot upgrade immediately, wrap Parse, ParseStrictDDL, and ParseNext invocations in a goroutine that installs a recover handler to contain panics.

bash

# Upgrade Temporal Server to a patched release
helm repo update
helm upgrade temporal temporalio/temporal --version 1.31.3

# Verify the running server version
temporal operator cluster describe --address <frontend-host>:7233

# For Go applications embedding the parser, bump the dependency
go get github.com/temporalio/sqlparser@v0.1.0
go mod tidy