CVE-2026-63747
HIGH
CVSS 8.7
SurrealDB
Verified Advisory
Denial of service via malformed RPC `use` call in SurrealDB (CVE-2026-63747)
SurrealDB's RPC `use` handler panics when a database is specified without a namespace, because the handler calls `.expect("namespace should be set")` and the core library is built with `panic = 'abort'`, causing the process to terminate. An unauthenticated remote attacker can trigger this crash with a single WebSocket message to the `/rpc` endpoint, requiring no credentials, token, or special capability.
Affected versions:
- <3.1.0
We recommend updating to: 3.1.0.
CVSS 8.7 · our assessment: this_week
Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wjjj-24cx-f28g
Details: https://vuln.today/cve/CVE-2026-63747
Verified by vuln.today against published advisories.
Affected versions
- – <3.1.0
Fixed in: 3.1.0
More advisories for SurrealDB
- CVE-2026-63760 – Denial of service in SurrealDB JSON parser via nested objects (CVE-2026-63760)
- CVE-2026-63759 – Denial of Service via nested type annotations in SurrealDB (CVE-2026-63759)
- CVE-2026-63757 – Session hijacking via unauthenticated /rpc session enumeration in SurrealDB (CVE-2026-63757)
- CVE-2026-63755 – Permission check bypass in SurrealDB SELECT and update statements (CVE-2026-63755)
- CVE-2026-63754 – Denial of service via malicious LIVE queries in SurrealDB (CVE-2026-63754)
- CVE-2026-63740 – Array element-level SELECT permission bypass in SurrealDB (CVE-2026-63740)
- CVE-2026-63739 – Arbitrary file read via DEFINE ANALYZER mapper filter in SurrealDB (CVE-2026-63739)
- CVE-2026-63737 – Denial of service via deep operator chains in SurrealDB (CVE-2026-63737)