CVE-2026-16651

The temporalio/sqlparser library, used by Temporal Server , can panic when parsing a MySQL version comment that is empty or contains only one to five decimal digits. The root cause is in ExtractMysqlComment , which does not handle the -1 return value from strings.IndexFunc before using it as a sl...

PT-2026-96072

Name of the Vulnerable Software and Affected Versions temporalio/sqlparser affected versions not specified Temporal Server affected versions not specified Description A panic occurs when the Parse, ParseStrictDDL, or ParseNext functions process a MySQL version comment that is empty or contains on...

CVE-2026-16651: Improper Validation of Array Index

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The...