CVE-2026-65651 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
An attacker can cause a fatal stack overflow in Temporal Server by submitting deeply nested SQL, leading to process termination and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65651?
CVE-2026-65651 is a high-severity denial of service vulnerability in Temporal Server, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Weakness: CWE-674
Which versions are affected by CVE-2026-65651?
How do I fix CVE-2026-65651?
No fix has been published for CVE-2026-65651 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-65651 being exploited?
There is no known exploitation of CVE-2026-65651 in the wild and no public exploit code.
Sources
Also known as GHSA-7vcf-7m3r-v7x3.