The temporalio/sqlparser component improperly validates array indices when parsing MySQL version comments. Specifically, the ExtractMysqlComment function uses the result of strings.IndexFunc without checking for a -1 return value, leading to out-of-bounds slice operations and a runtime panic in Go. This panic propagates unless recovered by the caller. Temporal Server exposes this parser via the ListWorkers API, which when enabled, allows authenticated users with namespace read permission to send malformed SQL queries that cause the Matching process to crash. This can be exploited repeatedly to sustain a denial of service condition. No confidentiality or integrity impacts are reported.

The vulnerability causes denial of service by crashing the Matching process in Temporal Server when parsing malformed SQL queries. It affects availability only. There is no known impact on confidentiality or integrity. Exploitation requires authentication with namespace read permission and the ListWorkers API to be enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the ListWorkers API to trusted users only and monitor for abnormal termination of the Matching process. Applications should implement recovery mechanisms for panics in parsing goroutines if possible.