# CVE-2026-109339: SurrealDB Surrealism module memory exhaustion via unbounded output buffering

Source: https://junglewise.ai/threats/cve-2026-109339-surrealdb-3-1-0-before-3-3-0-lets-surrealism-modules-exhaust  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109339 · Severity: medium · CVSS 4.9 · Published 2026-10-12

SurrealDB is a multi-model database server that supports experimental Surrealism modules for custom logic. A malicious or faulty module can exhaust the server's memory by writing output without line breaks, bypassing memory limits and crashing the entire server instance, denying service to all databases until restart. This requires the experimental Surrealism capability to be enabled and an Owner-role user to install a malicious module.

Technologies: [Surrealdb](https://junglewise.ai/threats/technologies/surrealdb-surrealdb). Vendors: [SurrealDB](https://junglewise.ai/threats/vendors/surrealdb).

## Quick answers

**Is CVE-2026-109339 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109339 being exploited in the wild.

**How severe is CVE-2026-109339?** Medium severity, with a CVSS score of 4.9, published 12 October 2026.

**Which products and versions are affected?** Surrealdb 3.1.0 before 3.3.0; SurrealDB Surrealism-Runtime 0.3.0 before 0.6.0.

**Is there a fix for CVE-2026-109339?** Yes: fixed in SurrealDB 3.3.0, surrealism-runtime 0.6.0. Until then: Disable the experimental Surrealism capability unless required (it is off by default; disable with --allow-experimental surrealism). Install only trusted modules, restrict Owner role membership, and use PERMISSIONS clauses on DEFINE MODULE to limit who can call module functions. Run SurrealDB under an orchestrator with automatic restart (Kubernetes, systemd, Docker) to minimize downtime. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109339 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-109339?** Check whether you run Surrealdb or SurrealDB Surrealism-Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SurrealDB 3.3.0, surrealism-runtime 0.6.0

Disable the experimental Surrealism capability unless required (it is off by default; disable with --allow-experimental surrealism). Install only trusted modules, restrict Owner role membership, and use PERMISSIONS clauses on DEFINE MODULE to limit who can call module functions. Run SurrealDB under an orchestrator with automatic restart (Kubernetes, systemd, Docker) to minimize downtime.

## Technical details

The vulnerability is an unbounded resource allocation (CWE-770) in SurrealDB's Surrealism module stdout/stderr handling. The host buffers incomplete output lines in server memory rather than module memory, circumventing the configured SURREAL_SURREALISM_MAX_MEMORY limit. An attacker with Owner role can define a malicious module that writes to stdout/stderr without newlines, causing the server process to exhaust memory and crash. The fix in 3.3.0 implements chunking of unfinished lines at a fixed size threshold.

## Affected products

- SurrealDB SurrealDB 3.1.0 before 3.3.0
- SurrealDB surrealism-runtime 0.3.0 before 0.6.0

## Timeline

- 2026-09-28: disclosed: GitHub security advisory published
- 2026-10-12: advisory: NVD entry published
- 2026-09-28: patched: Fix included in SurrealDB 3.3.0 and surrealism-runtime 0.6.0

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jj89-wvrw-c4gp](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jj89-wvrw-c4gp)
- [https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-memory-exhaustion-via-surrealism-module-output-buffering](https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-memory-exhaustion-via-surrealism-module-output-buffering)

## Related threats

- [SurrealDB unbounded recursion in value serialization](https://junglewise.ai/threats/cve-2026-121423-surrealdb-before-3-3-0-contains-an-unbounded-recursion)
- [SurrealDB server-side request forgery in JWKS URL validation](https://junglewise.ai/threats/cve-2026-121422-surrealdb-from-3-1-0-before-3-3-0-contains-a-server-side-request)
- [SurrealDB server-side request forgery in network deny rules](https://junglewise.ai/threats/cve-2026-121421-surrealdb-3-1-0-before-3-3-0-contains-a-server-side-request)
- [SurrealDB MCP session hijack via BoundSubject fingerprint collision](https://junglewise.ai/threats/cve-2026-121419-surrealdb-from-3-1-0-before-3-3-0-contains-an-improper)
- [SurrealDB authorization bypass via streaming index planner](https://junglewise.ai/threats/cve-2026-121418-surrealdb-from-3-1-0-before-3-3-0-contains-an-incorrect)