Executive brief
SurrealDB, a multi-model cloud database, is vulnerable to a denial-of-service attack. An authorized user with administrative (Owner) privileges can crash the entire database server by uploading a specially crafted machine learning model file. This results in a complete service outage for all users and databases on the affected instance until the system is manually restarted.
Technical details
A denial of service vulnerability exists in the SurrealML header parser of SurrealDB. The root cause is the use of unchecked unwrap() calls and array indexing on attacker-controlled header fields within the /ml/import endpoint. When a malformed .surml file (e.g., containing non-numeric input-dimensions) is uploaded, the parser triggers a Rust panic. Because the core is compiled with 'panic = abort', the entire server process terminates immediately. This attack requires network access and authentication with Owner-level privileges. The issue is resolved in version 3.2.0 by implementing proper error handling instead of panicking.
Affected products
- SurrealDB SurrealDB < 3.2.0
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published by SurrealDB
- 2026-07-20: disclosed: NVD and VulnCheck publication date