CVE-2026-16651: temporalio/sqlparser malformed MySQL version comments can cause a panic
Temporal Technologies, Inc. · temporalio/sqlparser
Vendor fix available · Affected: Temporal Technologies, Inc. temporalio/sqlparser · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 45% of scored CVEs
DescriptionCVE.org
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Temporal Technologies, Inc. · temporalio/sqlparserfrom 0.0.0-20180604150908-b055e9c9b4fa before 0.0.0-20260721183040-74181ffcbaaf
- Temporal Technologies, Inc. · Temporal Serverfrom 1.29.0 up to and including 1.29.7; from 1.30.0 before 1.30.7; from 1.31.0 before 1.31.3
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Published
- September 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-16651 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.