CVE-2026-63760
HIGH
CVSS 8.7
SurrealDB
Verified Advisory
Denial of service in SurrealDB JSON parser via nested objects (CVE-2026-63760)
The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. An unauthenticated remote attacker can exploit this by sending a deeply nested JSON payload to the WebSocket /rpc endpoint, exhausting server memory and crashing the process. No credentials or query execution privileges are required.
Affected versions:
- <3.1.0
We recommend updating to: 3.1.0.
CVSS 8.7 · our assessment: this_week
Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq
Details: https://vuln.today/cve/CVE-2026-63760
Verified by vuln.today against published advisories.
Affected versions
- – <3.1.0
Fixed in: 3.1.0
More advisories for SurrealDB
- CVE-2026-63759 – Denial of Service via nested type annotations in SurrealDB (CVE-2026-63759)
- CVE-2026-63757 – Session hijacking via unauthenticated /rpc session enumeration in SurrealDB (CVE-2026-63757)
- CVE-2026-63755 – Permission check bypass in SurrealDB SELECT and update statements (CVE-2026-63755)
- CVE-2026-63754 – Denial of service via malicious LIVE queries in SurrealDB (CVE-2026-63754)
- CVE-2026-63747 – Denial of service via malformed RPC `use` call in SurrealDB (CVE-2026-63747)
- CVE-2026-63740 – Array element-level SELECT permission bypass in SurrealDB (CVE-2026-63740)
- CVE-2026-63739 – Arbitrary file read via DEFINE ANALYZER mapper filter in SurrealDB (CVE-2026-63739)
- CVE-2026-63737 – Denial of service via deep operator chains in SurrealDB (CVE-2026-63737)