{"id":"CVE-2026-16651","summary":"temporalio/sqlparser malformed MySQL version comments can cause a panic","details":"temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.","modified":"2026-09-24T03:30:48.720474269Z","published":"2026-09-21T11:32:44.699Z","database_specific":{"cna_assigner":"Temporal","cwe_ids":["CWE-129"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16651.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.0.0-20180604150908-b055e9c9b4fa"},{"fixed":"0.0.0-20260721183040-74181ffcbaaf"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/temporalio/sqlparser/tree/v0.1.0"},{"type":"WEB","url":"https://pkg.go.dev"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16651.json"},{"type":"ADVISORY","url":"https://github.com/temporalio/temporal/releases/tag/v1.30.7"},{"type":"ADVISORY","url":"https://github.com/temporalio/temporal/releases/tag/v1.31.3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16651"},{"type":"FIX","url":"https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f"},{"type":"FIX","url":"https://github.com/temporalio/sqlparser/pull/5"},{"type":"FIX","url":"https://github.com/temporalio/temporal/pull/11090"},{"type":"FIX","url":"https://github.com/temporalio/temporal/pull/11190"},{"type":"PACKAGE","url":"https://github.com/temporalio/sqlparser"},{"type":"PACKAGE","url":"https://github.com/temporalio/temporal"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/temporalio/sqlparser","events":[{"introduced":"0"},{"fixed":"74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f"}],"database_specific":{"source":"REFERENCES"}},{"type":"GIT","repo":"https://github.com/temporalio/temporal","events":[{"introduced":"de42072bd282721e6dfc64780ee1662eb5f25184"},{"introduced":"f2a389fbab69f89edfb596d4963c04664db4cf89"},{"introduced":"83881961df2bad7d78d93a2d50778dbc8bd1a2fc"},{"fixed":"6263d75ecb887e4b11e67dab867c8af07260f36b"},{"fixed":"8c78934b67fbac43d2ea7f8ada448c539780584d"}],"database_specific":{"extracted_events":[{"introduced":"1.29.0"},{"last_affected":"1.29.7"},{"introduced":"1.30.0"},{"fixed":"1.30.7"},{"introduced":"1.31.0"},{"fixed":"1.31.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.31.2","v1.30.6","v1.30.5","v1.30.4.1","v1.31.1","v1.31.0","v1.30.4","v1.30.3","v1.30.2","v1.30.1","v1.30.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16651.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}