SurrealDB uncontrolled recursion in JSON parser

Executive brief

SurrealDB, a multi-model database, is vulnerable to a denial-of-service attack that can crash the server. An unauthenticated attacker can send a specially crafted, deeply nested message to the database's communication endpoint, causing it to exhaust memory and stop functioning. This could lead to service outages and impact business operations that rely on the database.

Technical details

The vulnerability is an uncontrolled recursion issue (CWE-674) within SurrealDB's `parse_value` and `parse_json` functions. While a recursion depth limit was previously implemented for the expression parser, it was omitted in the value/JSON parser code path. An unauthenticated attacker can exploit this by sending a single WebSocket message containing deeply nested tokens (e.g., `{`, `[`, or `(`) to the `/rpc` endpoint. This leads to excessive memory consumption and a process crash. The issue is addressed in version 3.1.0 by enforcing the configured recursion depth limit across all parser paths.

Affected products

• SurrealDB surrealdb < 3.1.0

Timeline

• 2026-05-27: disclosed: Initial report/discovery date
• 2026-07-01: advisory: GitHub Advisory published
• 2026-07-01: patched: Version 3.1.0 released with fix

References

• https://api.github.com/users/DarkaMaul
• https://github.com/DarkaMaul
• https://api.github.com/users/DarkaMaul/gists%7B/gist_id%7D
• https://api.github.com/users/DarkaMaul/repos
• https://avatars.githubusercontent.com/u/8711456?v=4
• https://api.github.com/users/DarkaMaul/events%7B/privacy%7D