# CVE-2026-16651: temporalio/sqlparser panic in MySQL version comment parsing

Source: https://junglewise.ai/threats/cve-2026-16651-temporalio-sqlparser-can-panic-when-parse-parsestrictddl-or  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-16651 · Severity: info · Published 2026-09-21

A Go-based SQL parser library used by Temporal Server can crash when processing specially crafted MySQL SQL queries with malformed version comments. In Temporal Server, an authenticated user with read permission can trigger this crash repeatedly to disable the Matching service, causing a denial of service. The vulnerability does not leak data or compromise system integrity.

Technologies: [Temporal Technologies Temporal Server](https://junglewise.ai/threats/technologies/temporal-server). Vendors: [Temporal Technologies](https://junglewise.ai/threats/vendors/temporal-technologies).

## Quick answers

**Is CVE-2026-16651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16651 being exploited in the wild.

**How severe is CVE-2026-16651?** Informational severity, published 21 September 2026.

**Which products and versions are affected?** Temporal Technologies sqlparser; Temporal Technologies Temporal Server.

**Is there a fix for CVE-2026-16651?** A patch was published on 2026-07-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16651 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16651?** Check whether you run Temporal Technologies Sqlparser or Temporal Technologies Temporal Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ExtractMysqlComment function in temporalio/sqlparser does not validate the return value of strings.IndexFunc before using it as a slice boundary, causing a panic when processing MySQL version comments that are empty or contain only 1-5 decimal digits. The vulnerability affects Parse, ParseStrictDDL, and ParseNext functions and requires an attacker to submit malformed SQL queries; Temporal Server exposes this through the ListWorkers API to authenticated callers.

## Affected products

- Temporal Technologies sqlparser
- Temporal Technologies Temporal Server

## Timeline

- 2026-09-21: disclosed
- 2026-07-21: patched

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f](https://github.com/temporalio/sqlparser/commit/74181ffcbaaf0c52faa925f4cf27ed6c0c2be86f)

## Related threats

- [Temporal Server workflow-history pagination token namespace bypass](https://junglewise.ai/threats/cve-2026-87857-temporal-server-does-not-bind-a-workflow-history-pagination-token)
- [Temporal Server arbitrary command execution via Kubernetes worker configuration](https://junglewise.ai/threats/cve-2026-120091-temporal-server-compiles-a-worker-controller-instance-module-go)
- [Temporal Server namespace bypass in internal completion callbacks](https://junglewise.ai/threats/cve-2026-89140-temporal-server-does-not-bind-internal-completion-callbacks-to)
- [Temporal Server local namespace modification via replication](https://junglewise.ai/threats/cve-2026-104355-a-connected-peer-cluster-can-modify-a-temporal-server-cluster-s)
- [Temporal Server arbitrary command execution via subprocess compute provider](https://junglewise.ai/threats/cve-2026-89139-temporal-server-compiles-a-worker-controller-instance-module-into)