CVE-2026-65651: 
Wolfi vulnerability analysis and mitigation

CVE-2026-65651 is an uncontrolled recursion vulnerability in temporalio/sqlparser that allows an authenticated attacker to trigger a runtime-fatal Go stack overflow, terminating Temporal Server's Frontend or Matching processes. The library accepts SQL with deeply nested unary expressions and builds a correspondingly deep abstract syntax tree (AST) without enforcing a nesting limit; its String and Walk operations then recursively traverse that tree, causing a stack overflow that Go's panic recovery cannot contain. Affected products include github.com/temporalio/sqlparser (all versions before 0.0.0-20260721183058-0466b6b405ac) and go.temporal.io/server versions 0.10.0–1.29.7, 1.30.0–1.30.6, and 1.31.0–1.31.2. It was published on September 21, 2026, and carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is CWE-674 (Uncontrolled Recursion): temporalio/sqlparser parses SQL into an AST without enforcing a maximum nesting depth, so deeply nested unary expressions (e.g., hundreds of NOT or ~ operators chained together) or deeply left-recursive expressions (e.g., thousands of AND clauses) produce an arbitrarily deep tree. When Temporal Server subsequently calls String() or Walk() on this tree — including during error construction in validation paths — the recursive traversal exhausts the Go goroutine stack, producing a fatal runtime: goroutine stack exceeds panic that cannot be caught by recover(). The fix introduced a maxExprDepth constant of 1000 and a post-parse checkExprDepth() function that walks the AST iteratively and returns an error before any recursive consumer can overflow (sqlparser PR #6, fix commit). A supplementary PR #7 extended the depth limit to cover all SQLNode types beyond Expr nodes (sqlparser PR #7).

Exploitation causes an immediate, unrecoverable process termination of the Temporal Server Frontend or Matching service, resulting in a complete denial of service for all workflows and activities routed through those components. Repeated crafted requests can sustain the outage indefinitely. The vulnerability has no confidentiality or integrity impact — no data is exposed or modified (GitHub Advisory).

No public proof-of-concept exploit code exists and no in-the-wild exploitation has been observed as of the disclosure date (GitHub Advisory). Exploitation requires authentication: the attacker must hold at least namespace read permission in a supported Temporal Server deployment. The ListWorkers route additionally requires at least one retained worker heartbeat to be exploitable. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable (GitHub Advisory).

1. Authenticate: Obtain credentials for a Temporal Server account with at least namespace read permission on the target deployment.
2. Craft malicious SQL query: Construct a SQL query containing deeply nested unary expressions exceeding the parser's stack capacity — for example, a SELECT statement with 300+ chained NOT operators (select 1 from t where not not not ... 1) or 1000+ AND clauses (select 1 from t where a=1 and a=1 and ... a=1), as demonstrated in the library's own test cases.
3. Submit to a vulnerable endpoint: Send the crafted query to one of the affected Temporal Server API paths — archival query, visibility query, or worker-query (e.g., ListWorkflowExecutions with a custom query filter, or ListWorkers if a worker heartbeat is retained).
4. Trigger stack overflow: The server passes the query through sqlparser.Parse(), which returns a deeply nested AST. During validation error construction, the server calls String() on the AST, recursively traversing the tree until the goroutine stack is exhausted.
5. Process termination: The Go runtime raises a fatal stack overflow panic that recover() cannot intercept, terminating the Frontend or Matching process and causing a denial of service.
6. Sustain DoS: Repeat requests to prevent process recovery and maintain the outage (GitHub Advisory, sqlparser PR #6).

• Logs: Temporal Server logs showing runtime: goroutine stack exceeds or stack overflow fatal errors immediately preceding process exit; repeated error-level log entries from the Frontend or Matching service related to query parsing or validation.
• Process: Unexpected termination/restart of the temporal-server process (specifically the Frontend or Matching role); process monitoring alerts for abnormal exits with non-zero exit codes.
• Network: Repeated API calls to visibility, archival, or worker-query endpoints (e.g., ListWorkflowExecutions, ListWorkers) from the same authenticated principal, particularly with unusually large or structurally repetitive query strings in request payloads.
• Application Behavior: Sudden unavailability of Temporal Frontend or Matching services coinciding with authenticated query submissions; workflow scheduling failures or task queue errors following process crashes.

Upgrade go.temporal.io/server to version 1.30.7 or 1.31.3 (or later), which incorporate the patched temporalio/sqlparser version 0.0.0-20260721183058-0466b6b405ac (Temporal v1.30.7 release, Temporal v1.31.3 release). Servers running versions 0.10.0–1.29.7 should upgrade to at least 1.30.7 or 1.31.3 as no patch is available for the 1.29.x line. As a compensating control, restrict namespace read permissions to trusted users only and implement rate limiting or request size limits on query submission endpoints to reduce the feasibility of sustained denial-of-service attacks (GitHub Advisory).