Executive brief
SurrealDB is a multi-model cloud database used for managing large-scale data applications. A vulnerability in its data processing component allows an unauthenticated attacker to crash the database server by sending a specially crafted message. This results in a complete service outage, preventing legitimate users and applications from accessing or storing data.
Technical details
A denial-of-service vulnerability exists in SurrealDB's value and JSON parser due to uncontrolled recursion (CWE-674). While the expression parser previously enforced recursion limits, the `parse_value` and `parse_json` functions failed to do so when encountering nested tokens such as braces, brackets, or parentheses. An unauthenticated remote attacker can exploit this by sending a single, deeply nested JSON payload to the WebSocket `/rpc` endpoint. This causes the server to exhaust its memory or stack space, leading to a process crash. This issue is an incomplete fix for a previous vulnerability (GHSA-6r8p-hpg7-825g) and is resolved in version 3.1.0.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: Initial GHSA advisory published
- 2026-07-20: disclosed: CVE-2026-63760 published