Junglewise Threat Intelligence

SurrealDB uncontrolled recursion in nested type annotations

Severity: medium · CVSS 6.5 · Published 2026-07-01

Technologies: surrealdb (crates.io). Vendors: crates.io, SurrealDB.

Executive brief

SurrealDB is a cloud-native database platform. A vulnerability in how the system handles complex data type descriptions allows an authenticated user to crash the database server. By sending a specially crafted message with deeply nested data types, an attacker can exhaust the server's memory, leading to a denial of service and potential disruption of business operations.

Technical details

The SurrealDB type/kind parser fails to enforce recursion depth limits when processing nested type annotations (e.g., deeply nested 'array' or 'option' types). This is an incomplete fix for a previous vulnerability (GHSA-6r8p-hpg7-825g) that only addressed the expression parser. An authenticated attacker with query execution privileges can trigger uncontrolled recursion in the 'parse_concrete_kind' and 'parse_inner_kind' functions, leading to memory exhaustion and a process crash. The vulnerability is primarily exploitable via the WebSocket /rpc endpoint, as the HTTP /sql endpoint has a 1 MiB body limit that mitigates the attack. The issue is resolved in version 3.1.0 by implementing the 'enter_object_recursion!' macro to bound recursive cycles.

Affected products

  • SurrealDB SurrealDB < 3.1.0

Timeline

  • 2026-05-27: disclosed: Initial disclosure date
  • 2026-07-01: advisory: GitHub Advisory published
  • 2026-07-01: patched: Fix confirmed in version 3.1.0

References

Related threats