Executive brief
SurrealDB is a multi-model database used as a backend for web and enterprise applications. A vulnerability exists that allows an authorized user to crash the database by sending a specially formatted request containing a null byte. This results in a complete service outage for the database and any applications that rely on it for data.
Technical details
An uncaught exception (CWE-248) exists in the 'net' module of SurrealDB. The vulnerability is triggered when the database attempts to convert a query result containing a null byte into JSON format for an HTTP response via the /sql endpoint. An authenticated attacker can exploit this by sending a crafted HTTP query that returns a null byte, leading to an unhandled exception that terminates the SurrealDB process. This issue is resolved in versions 2.0.5, 2.1.5, and 2.2.2.
Affected products
- SurrealDB SurrealDB < 2.0.5, < 2.1.5, < 2.2.2
Timeline
- 2025-04-10: advisory: GitHub Security Advisory published
- 2026-07-18: disclosed: NVD publication date