Temporalio Sqlparser
Monthly
Denial of service in Temporal Server stems from uncontrolled recursion (CWE-674) in the bundled temporalio/sqlparser library: SQL containing deeply nested unary expressions is accepted and produces a correspondingly deep abstract syntax tree, and the library's recursive String and Walk traversals then exhaust the Go stack and abort the process in a way that Go panic recovery cannot contain. Affected are Temporal Server deployments prior to v1.30.7 and v1.31.3 that pass caller-controlled query text to the parser through the archival, visibility, and worker-query paths, including validation code that recursively formats an invalid expression while constructing an error. Exploitation requires an authenticated caller holding namespace read permission (the published CVSS 4.0 vector lists PR:N, but the reported prerequisites specify an authenticated caller and the independent assessment scores PR:L), the dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat, and repeated requests can sustain the outage; impact is availability-only and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash the receiving Matching process by submitting a malformed MySQL version comment through the ListWorkers API when that API is enabled. The root cause is in the bundled temporalio/sqlparser Go library, where ExtractMysqlComment fails to validate the -1 returned by strings.IndexFunc before using it as a slice boundary, producing an unhandled Go runtime panic whenever a '/*! ... */' comment has empty contents or one to five decimal digits. Impact is availability-only (process termination, repeatable to sustain an outage) with no confidentiality or integrity effect; no public exploit identified at time of analysis, and exploitation is gated on both API enablement and authenticated namespace read access.
Denial of service in Temporal Server stems from uncontrolled recursion (CWE-674) in the bundled temporalio/sqlparser library: SQL containing deeply nested unary expressions is accepted and produces a correspondingly deep abstract syntax tree, and the library's recursive String and Walk traversals then exhaust the Go stack and abort the process in a way that Go panic recovery cannot contain. Affected are Temporal Server deployments prior to v1.30.7 and v1.31.3 that pass caller-controlled query text to the parser through the archival, visibility, and worker-query paths, including validation code that recursively formats an invalid expression while constructing an error. Exploitation requires an authenticated caller holding namespace read permission (the published CVSS 4.0 vector lists PR:N, but the reported prerequisites specify an authenticated caller and the independent assessment scores PR:L), the dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat, and repeated requests can sustain the outage; impact is availability-only and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash the receiving Matching process by submitting a malformed MySQL version comment through the ListWorkers API when that API is enabled. The root cause is in the bundled temporalio/sqlparser Go library, where ExtractMysqlComment fails to validate the -1 returned by strings.IndexFunc before using it as a slice boundary, producing an unhandled Go runtime panic whenever a '/*! ... */' comment has empty contents or one to five decimal digits. Impact is availability-only (process termination, repeatable to sustain an outage) with no confidentiality or integrity effect; no public exploit identified at time of analysis, and exploitation is gated on both API enablement and authenticated namespace read access.