EUVD-2026-83892
GHSA-7vcf-7m3r-v7x3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description requires an authenticated caller with namespace read permission (PR:L, not PR:N); low complexity, network-reachable, availability-only fatal process crash so A:H, C:N/I:N.
Primary rating from Vendor (Temporal).
CVSS VectorVendor: Temporal
Lifecycle Timeline
3DescriptionCVE.org
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.
AnalysisAI
Denial of service in Temporal Server stems from uncontrolled recursion (CWE-674) in the bundled temporalio/sqlparser library: SQL containing deeply nested unary expressions is accepted and produces a correspondingly deep abstract syntax tree, and the library's recursive String and Walk traversals then exhaust the Go stack and abort the process in a way that Go panic recovery cannot contain. Affected are Temporal Server deployments prior to v1.30.7 and v1.31.3 that pass caller-controlled query text to the parser through the archival, visibility, and worker-query paths, including validation code that recursively formats an invalid expression while constructing an error. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated caller with namespace read permission against a Temporal Server deployment that routes caller-controlled SQL through the temporalio/sqlparser parser - specifically the archival, visibility, or worker-query paths (validation paths that recursively format an invalid expression when constructing an error). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability issue (CWE-674 uncontrolled recursion → unrecoverable Go stack overflow). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading Temporal Server to v1.30.7 or v1.31.3 (https://github.com/temporalio/temporal/releases/tag/v1.30.7, https://github.com/temporalio/temporal/releases/tag/v1.31.3), which is delivered through the dependency bump in https://github.com/temporalio/temporal/pull/11202 raising github.com/temporalio/sqlparser to v0.0.0-20260722001706-17d16cfe1da5; downstream consumers that vendor the library directly should move to the sqlparser revisions containing the nesting limit (commits 0466b6b405accfaa781e4bef417933efc18bcaef and 1aae9baceee8e48525da8f56b07bf6a5ca7eb147, PRs #6 and #7). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Temporal Server instances and identify any running a version below v1.30.7 or v1.31.3, paying particular attention to deployments exposing the archival, visibility, and worker-query paths to caller-supplied query text; for any such instance that is externally reachable or serves less-trusted callers, apply network-level restrictions and review namespace read grants, since the reported prerequisites require an authenticated caller holding namespace read permission (the published CVSS 4.0 vector lists PR:N, so the authentication assessment is not fully settled). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today