Junglewise Threat Intelligence

CVE-2026-63734: SurrealDB denial of service via malformed SurrealML import

CVE-2026-63734 · Severity: medium · CVSS 4.9 · Published 2026-07-20

Vendors: SurrealDB.

Executive brief

SurrealDB, a multi-model cloud database, is vulnerable to a denial-of-service attack. An authorized user with administrative (Owner) privileges can crash the entire database server by uploading a specially crafted machine learning model file. This results in a complete service outage for all users and databases on the affected instance until the system is manually restarted.

Technical details

A denial of service vulnerability exists in the SurrealML header parser of SurrealDB. The root cause is the use of unchecked unwrap() calls and array indexing on attacker-controlled header fields within the /ml/import endpoint. When a malformed .surml file (e.g., containing non-numeric input-dimensions) is uploaded, the parser triggers a Rust panic. Because the core is compiled with 'panic = abort', the entire server process terminates immediately. This attack requires network access and authentication with Owner-level privileges. The issue is resolved in version 3.2.0 by implementing proper error handling instead of panicking.

Affected products

  • SurrealDB SurrealDB < 3.2.0

Timeline

  • 2026-07-02: advisory: GitHub Security Advisory published by SurrealDB
  • 2026-07-20: disclosed: NVD and VulnCheck publication date

References