Vulnerability in Temporal Server SQL Parser Leading to DoS

CVE-2026-65651

What is CVE-2026-65651?

A vulnerability exists in Temporal Server's SQL parser that allows for the acceptance of SQL queries containing deeply nested unary expressions. This can result in the generation of excessively deep abstract syntax trees that do not have a defined nesting limit. When recursively traversing these trees, applications may experience a runtime-fatal Go stack overflow, abruptly terminating the process. This vulnerability primarily affects the availability of the server, as a caller with appropriate namespace permissions can invoke repeatedly crafted queries that lead to service disruption through Denial of Service attacks. The issue has been addressed in subsequent patches; however, it remains crucial for administrators to audit deployments for potentially vulnerable versions.

References