The vulnerability arises when the parser processes a MySQL version comment that is empty or contains only one to five decimal digits, leading to a Go runtime panic caused by improper slice boundary handling. This panic is not recovered by default, causing the process that executes the parser to terminate. The affected component is the SQL parser in Temporal Platforms and can compromise availability; no confidentiality or integrity impact has been identified. The weakness is identified as CWE‑129, an integer boundary manipulation flaw.

Affecting Temporal Technologies, Inc. products, specifically the Temporal Server and the temporalio/sqlparser library. Versions prior to v0.0.0-20260721183040-74181ffcbaaf for the parser and before Temporal Server releases 1.30.7 (for 1.x series), 1.31.3, or 1.32.0 for their respective minor line must be patched or otherwise mitigated.

With a CVSS score of 7.1 the flaw is considered serious, though the EPSS score is not available at this time and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via an authenticated request to the ListWorkers API where the caller has namespace read permission; the attacker crafts a malformed query that triggers the parser panic. An attacker may repeatedly invoke the vulnerable endpoint, leading to sustained denial of service on the matching process.