Executive brief
SurrealDB is a cloud-native database platform. A vulnerability in how the system handles complex data type descriptions allows an authenticated user to crash the database server. By sending a specially crafted message with deeply nested data types, an attacker can exhaust the server's memory, leading to a denial of service and potential disruption of business operations.
Technical details
The SurrealDB type/kind parser fails to enforce recursion depth limits when processing nested type annotations (e.g., deeply nested 'array' or 'option' types). This is an incomplete fix for a previous vulnerability (GHSA-6r8p-hpg7-825g) that only addressed the expression parser. An authenticated attacker with query execution privileges can trigger uncontrolled recursion in the 'parse_concrete_kind' and 'parse_inner_kind' functions, leading to memory exhaustion and a process crash. The vulnerability is primarily exploitable via the WebSocket /rpc endpoint, as the HTTP /sql endpoint has a 1 MiB body limit that mitigates the attack. The issue is resolved in version 3.1.0 by implementing the 'enter_object_recursion!' macro to bound recursive cycles.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: disclosed: Initial disclosure date
- 2026-07-01: advisory: GitHub Advisory published
- 2026-07-01: patched: Fix confirmed in version 3.1.0