Executive brief
A vulnerability in SurrealDB allows an authenticated user to block all data modifications on a specific database table. By submitting a specially crafted 'LIVE' query that contains a deliberate error, the attacker causes any subsequent attempts by other users—including administrators—to create, update, or delete records to fail. This results in a denial-of-service condition for that table until the malicious query is terminated or the attacker's session ends.
Technical details
A vulnerability in SurrealDB's LIVE query notification path allows for a denial-of-service (DoS) attack. When a LIVE query's WHERE clause evaluates to an error (e.g., passing an incorrect type to a SurrealQL function), this error propagates back to the transaction that triggered the notification. Consequently, any CREATE, UPDATE, or DELETE operation on the watched table is rolled back, even if performed by a root user. The attack requires the 'select' permission on the target table. The issue is fixed in version 3.1.0 by decoupling LIVE query evaluation errors from the source transaction and deferring error notifications until after permission checks.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: disclosed: Initial disclosure to vendor
- 2026-07-01: advisory: GitHub Advisory published
- 2026-07-01: patched: Fix released in version 3.1.0