A high-severity denial of service vulnerability in Temporal Server allows authenticated attackers to crash critical system processes through specifically crafted SQL queries.

This is an uncontrolled recursion flaw (CWE-674) where the sqlparser library fails to limit nesting depth during SQL parsing. The vulnerability is reachable by authenticated users with namespace read permissions, who can trigger a runtime-fatal Go stack overflow that crashes the Frontend or Matching services.

Successful exploitation of this vulnerability results in a denial of service for the affected Temporal Server processes. Because these processes are central to workflow orchestration, an attacker can effectively halt business operations, leading to significant system downtime and operational disruption. While the CVSS score of 8.7 reflects a high-severity impact on system availability, the lack of confidentiality or integrity impact limits the scope of the threat to service uptime.

Immediate Action: Update the sqlparser dependency to version 0.0.0-20260721183058-0466b6b405ac or later, and upgrade Temporal Server to version 1.30.7, 1.31.3, or 1.32.0, depending on your current release line.

Proactive Monitoring: Monitor server logs for repeated process crashes or recurring "stack overflow" errors, and audit access logs for unusual or highly complex SQL queries originating from authorized service accounts.

Compensating Controls: Implement strict input validation or rate limiting at the application gateway to inspect incoming SQL queries for excessive nesting or unusual complexity before they reach the parser.

Public Exploit Available: No

Given the potential for service disruption, organizations should prioritize upgrading the affected Temporal Server and sqlparser components. Testing the patch in a development or staging environment is recommended to ensure compatibility, followed by a controlled deployment to production to restore stability and mitigate the risk of denial of service attacks.