CVE-2026-16651: temporalio/sqlparser panic in MySQL version comment parsing

Executive brief

A Go-based SQL parser library used by Temporal Server can crash when processing specially crafted MySQL SQL queries with malformed version comments. In Temporal Server, an authenticated user with read permission can trigger this crash repeatedly to disable the Matching service, causing a denial of service. The vulnerability does not leak data or compromise system integrity.

Technical details

The ExtractMysqlComment function in temporalio/sqlparser does not validate the return value of strings.IndexFunc before using it as a slice boundary, causing a panic when processing MySQL version comments that are empty or contain only 1-5 decimal digits. The vulnerability affects Parse, ParseStrictDDL, and ParseNext functions and requires an attacker to submit malformed SQL queries; Temporal Server exposes this through the ListWorkers API to authenticated callers.

Affected products

• Temporal Technologies sqlparser
• Temporal Technologies Temporal Server

Timeline

• 2026-09-21: disclosed
• 2026-07-21: patched

References

• https://pkg.go.dev/
• https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f