Answer in brief
CVE-2026-65651 records a High severity (CVSS 8.7) vulnerability in temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal. The current sources do not mark it as known exploited. The current feed maps Temporal Technologies, Inc./github.com/temporalio/sqlparser (generic), Temporal Technologies, Inc./go.temporal.io/server (generic), Temporal Technologies, Inc./temporalio/sqlparser (generic), Temporal Technologies, Inc./Temporal Server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Temporal Technologies, Inc./github.com/temporalio/sqlparser (generic), Temporal Technologies, Inc./go.temporal.io/server (generic), Temporal Technologies, Inc./temporalio/sqlparser (generic), Temporal Technologies, Inc./Temporal Server (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Temporal Technologies, Inc./github.com/temporalio/sqlparsergeneric | >=0.0.0-20141206041240-1aae9baceee8 <0.0.0-20260721183058-0466b6b405ac | 0.0.0-20260721183058-0466b6b405ac |
| Temporal Technologies, Inc./go.temporal.io/servergeneric | >=0.10.0 <=1.29.7 || >=1.30.0 <1.30.7 || >=1.31.0 <1.31.3 | 1.30.7, 1.31.3 |
| Temporal Technologies, Inc./temporalio/sqlparsergeneric | >=0.0.0-20141206041240-1aae9baceee8 <0.0.0-20260721183058-0466b6b405ac | 0.0.0-20260721183058-0466b6b405ac |
| Temporal Technologies, Inc./Temporal Servergeneric | 0.10.0 || >=1.30.0 <1.30.7 || >=1.31.0 <1.31.3 | 1.30.7, 1.31.3 |
Published upstream
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 21, 2026
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
Quoted source text, attributed separately from HOL analysis.