The temporalio/sqlparser library accepts SQL queries containing deeply nested unary expressions without enforcing nesting limits. Its String and Walk operations recursively traverse the resulting abstract syntax tree, which can be arbitrarily deep. When an application parses attacker-controlled SQL and later formats or walks the tree, it may trigger a Go runtime stack overflow that crashes the process. Temporal Server passes caller-controlled queries through this parser in archival, visibility, and worker-query paths. In validation, the server recursively formats invalid expressions while constructing errors. An authenticated user with namespace read permission can exploit this to terminate Frontend or Matching processes, sustaining denial of service through repeated requests. The vulnerability impacts availability only and does not affect confidentiality or integrity.

Exploitation of this vulnerability results in denial of service by causing a runtime-fatal stack overflow in Go, terminating affected Temporal Server processes such as Frontend or Matching. Attackers with namespace read permission can repeatedly trigger this condition, sustaining service disruption. There is no confidentiality or integrity impact identified.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to authenticated users with namespace read permission and monitor for unusual termination of Frontend or Matching processes. Avoid processing untrusted or attacker-controlled deeply nested SQL expressions where possible.