Executive brief
SurrealDB is a multi-model cloud database. A vulnerability in its communication interface allows an unauthenticated attacker to crash the database server by sending a single specially crafted message. This results in a complete service outage, preventing applications and users from accessing their data until the server is manually or automatically restarted.
Technical details
A denial of service vulnerability exists in SurrealDB's RPC 'use' handler due to an uncaught exception (CWE-248). When a WebSocket message specifies a database ('db') without first selecting a namespace ('ns'), the server triggers an '.expect()' call that fails. Because the core is compiled with 'panic = abort', this failure immediately terminates the server process. The vulnerability is reachable by unauthenticated remote attackers via the /rpc endpoint, as the 'use' method is accessible to guest callers by default. This issue is resolved in version 3.1.0, which replaces the panic with a proper error response.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE-2026-63747 published to NVD