temporalio/sqlparser vulnerabilities

2 known vulnerabilities in temporalio/sqlparser from Temporal Technologies. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  temporalio/sqlparser: Uncontrolled Recursion

  CVE-2026-65651Sep 21, 2026Temporal Technologies

  temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An ap

• 8.7 High severity

  temporalio/sqlparser: Improper Validation of Array Index

  CVE-2026-16651Sep 21, 2026Temporal Technologies

  temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc bef