Executive brief
SurrealDB is a multi-model database used for managing and querying large-scale data. A vulnerability allows an authenticated user to crash the database server by sending a specially crafted query with an extremely long chain of mathematical or logical operators. This results in a complete service outage for all users on the affected instance until the system is manually or automatically restarted.
Technical details
A denial of service vulnerability exists in SurrealDB's query parser due to uncontrolled recursion (CWE-674). While the database has existing recursion limits, the Pratt parser used for expressions appends operators iteratively to a flat chain that bypasses these checks, resulting in an unbounded expression tree. When this tree is later walked recursively during dropping, formatting, or execution, it triggers a stack overflow that aborts the process. An authenticated attacker with query-execution privileges can exploit this over a network by submitting a query containing tens of thousands of terms (e.g., 'RETURN 1 + 1 + ...'). The issue is resolved in version 3.1.5 by introducing a dedicated expression-depth budget.
Affected products
- SurrealDB SurrealDB >= 3.0.0, < 3.1.5
Timeline
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date