# SurrealDB JSON parser denial of service via uncontrolled recursion

Source: https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-07-20

SurrealDB is a document database that accepts queries through a WebSocket JSON interface. Due to an incomplete fix, the JSON parser fails to enforce recursion depth limits when processing deeply nested structures. An unauthenticated attacker can send a crafted WebSocket message with nested JSON braces, brackets, or parentheses to exhaust server memory and crash the database process, causing complete service unavailability.

Technologies: [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 20 July 2026.

**Which products and versions are affected?** surrealdb (crates.io) < 3.1.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-27: Fix released in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an uncontrolled recursion flaw (CWE-674) in SurrealDB's JSON and value parser components. The expression parser correctly enforces a configured recursion depth limit, but the parse_value and parse_json functions omitted this check—a gap that was overlooked when a related expression parser vulnerability (GHSA-6r8p-hpg7-825g) was previously patched. An unauthenticated attacker with network access to the WebSocket /rpc endpoint can send a single malicious message containing deeply nested JSON structures (e.g., many nested braces, brackets, or parentheses) without authentication or special privileges. This causes the parser to recurse excessively, consuming memory until the server process crashes. The patch enforces recursion depth limits in parse_value and parse_json to match the expression parser behavior; versions 3.1.0 and later are not affected.

## Affected products

- SurrealDB SurrealDB < 3.1.0

## Timeline

- 2026-05-27: disclosed: Original advisory GHSA-q729-696q-g9pq published
- 2026-05-27: patched: Fix released in version 3.1.0
- 2026-07-20: advisory: Duplicate advisory GHSA-m464-hj36-96vx published
- 2026-09-04: other: Duplicate advisory withdrawn

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq)
- [https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser](https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser)

## Related threats

- [SurrealDB use-after-free in KV backends via affinitypool spawn_local](https://junglewise.ai/threats/cve-2026-121417-surrealdb-before-3-3-0-contains-a-use-after-free-vulnerability)
- [SurrealDB ES512 algorithm silently downgraded to ES384](https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8)
- [SurrealDB permission bypass via WHERE clause evaluation](https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001)
- [SurrealDB authorization bypass in KILL statement](https://junglewise.ai/threats/surrealdb-authorization-bypass-in-kill-statement-fc230d0f)
- [SurrealDB port-specific deny-net rule bypass on HTTP redirect](https://junglewise.ai/threats/surrealdb-port-specific-deny-net-rule-bypass-on-http-redirect-855c5516)