CVE-2026-63754
HIGH
CVSS 7.1
SurrealDB
Verified Advisory
Denial of service via malicious LIVE queries in SurrealDB (CVE-2026-63754)
A LIVE query whose WHERE clause evaluates to an error causes the error to propagate to the triggering write transaction, rolling back the attempted change. An authenticated user with only select permission on a table can prevent all CREATE, UPDATE, and DELETE operations on that table - including those issued by a root user - for the lifetime of the registered LIVE query.
Affected versions:
- <3.1.0
We recommend updating to: 3.1.0.
CVSS 7.1 · our assessment: this_week
Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4v76-cw68-4vc9
Details: https://vuln.today/cve/CVE-2026-63754
Verified by vuln.today against published advisories.
Affected versions
- – <3.1.0
Fixed in: 3.1.0
More advisories for SurrealDB
- CVE-2026-63760 – Denial of service in SurrealDB JSON parser via nested objects (CVE-2026-63760)
- CVE-2026-63759 – Denial of Service via nested type annotations in SurrealDB (CVE-2026-63759)
- CVE-2026-63757 – Session hijacking via unauthenticated /rpc session enumeration in SurrealDB (CVE-2026-63757)
- CVE-2026-63755 – Permission check bypass in SurrealDB SELECT and update statements (CVE-2026-63755)
- CVE-2026-63747 – Denial of service via malformed RPC `use` call in SurrealDB (CVE-2026-63747)
- CVE-2026-63740 – Array element-level SELECT permission bypass in SurrealDB (CVE-2026-63740)
- CVE-2026-63739 – Arbitrary file read via DEFINE ANALYZER mapper filter in SurrealDB (CVE-2026-63739)
- CVE-2026-63737 – Denial of service via deep operator chains in SurrealDB (CVE-2026-63737)