Executive brief
SurrealDB, a cloud-native database, is vulnerable to a denial-of-service attack through its WebSocket interface. An unauthenticated attacker can send large amounts of data that bypass configured size limits, potentially exhausting the server's memory. This can lead to service slowdowns or cause the database to crash, impacting application availability.
Technical details
A resource exhaustion vulnerability exists in SurrealDB's /sql WebSocket upgrade handler. The handler fails to propagate the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous connections, allowing the per-connection read buffer to accumulate frames up to the underlying library defaults (16 MiB per frame, 64 MiB per message) regardless of operator configuration. An unauthenticated remote attacker can exploit this by streaming large WebSocket frames across multiple concurrent connections to trigger memory amplification. This can lead to degraded availability or Out-of-Memory (OOM) kills. The issue is fixed in version 3.1.0 by enforcing capability checks and size limits before the protocol upgrade.
Affected products
- surrealdb surrealdb < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD