Is CVE-2026-63760 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63760 being exploited in the wild.

How severe is CVE-2026-63760?

High severity, with a CVSS score of 7.5, published 20 July 2026.

Which products and versions are affected?

surrealdb (crates.io) SEMVER:introduced=0,fixed=3.1.0.

Is there a fix for CVE-2026-63760?

Yes. surrealdb (crates.io): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63760 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63760?

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63760: SurrealDB uncontrolled recursion in JSON parser

CVE-2026-63760 · Severity: high · CVSS 7.5 · Published 2026-07-20

SurrealDB is a multi-model cloud database used for managing large-scale data applications. A vulnerability in its data processing component allows an unauthenticated attacker to crash the database server by sending a specially crafted message. This results in a complete service outage, preventing legitimate users and applications from accessing or storing data.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63760 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63760 being exploited in the wild.
How severe is CVE-2026-63760?: High severity, with a CVSS score of 7.5, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2026-63760?: Yes. surrealdb (crates.io): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63760 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63760?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

surrealdb (crates.io): upgrade to 3.1.0 or later
```
cargo update -p surrealdb
```

Technical details

A denial-of-service vulnerability exists in SurrealDB's value and JSON parser due to uncontrolled recursion (CWE-674). While the expression parser previously enforced recursion limits, the `parse_value` and `parse_json` functions failed to do so when encountering nested tokens such as braces, brackets, or parentheses. An unauthenticated remote attacker can exploit this by sending a single, deeply nested JSON payload to the WebSocket `/rpc` endpoint. This causes the server to exhaust its memory or stack space, leading to a process crash. This issue is an incomplete fix for a previous vulnerability (GHSA-6r8p-hpg7-825g) and is resolved in version 3.1.0.

Affected products

SurrealDB SurrealDB < 3.1.0

Identifiers

CVE-2026-63760
GHSA-q729-696q-g9pq

Timeline

2026-05-27: advisory: Initial GHSA advisory published
2026-07-20: disclosed: CVE-2026-63760 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.