---
id: CVE-2026-16651
title: >-
  temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext
  processes a MySQL version comment whose contents are empty or consist only of
  one to five decimal digits
summary: >-
  temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext
  processes a MySQL version comment whose contents are empty or consist only of
  one to five decimal digits. ExtractMysqlComment does not check the -1 result
  returned b…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-129
vendor: 'Temporal Technologies, Inc.'
product: github.com/temporalio/sqlparser
affected:
  - >-
    github.com/temporalio/sqlparser >= 0.0.0-20180604150908-b055e9c9b4fa <
    0.0.0-20260721183040-74181ffcbaaf
  - go.temporal.io/server >= 1.29.0 <= 1.29.7
  - go.temporal.io/server >= 1.30.0 < 1.30.7
  - go.temporal.io/server >= 1.31.0 < 1.31.3
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:40:05.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16651'
references:
  - url: >-
      https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f
    label: security@temporal.io
  - url: 'https://github.com/temporalio/sqlparser/pull/5'
    label: security@temporal.io
  - url: 'https://github.com/temporalio/sqlparser/tree/v0.1.0'
    label: security@temporal.io
  - url: 'https://github.com/temporalio/temporal/pull/11090'
    label: security@temporal.io
  - url: 'https://github.com/temporalio/temporal/pull/11190'
    label: security@temporal.io
  - url: 'https://github.com/temporalio/temporal/releases/tag/v1.30.7'
    label: security@temporal.io
  - url: 'https://github.com/temporalio/temporal/releases/tag/v1.31.3'
    label: security@temporal.io
tags:
  - nvd
  - cve.org
epss: 0.0039
epssPercentile: 0.3036
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T15:32:17.328992Z'
cvssSource: cna
ingestedAt: '2026-09-21T12:36:35.286Z'
---

## Overview

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.