SurrealDB CVE-2026-109338

Requires two concrete prerequisites both drawn from the description: (1) the embedded JavaScript scripting feature must be enabled on the SurrealDB instance (scripting is a security-sensitive, non-default capability), and (2) the attacker must be a query-capable authenticated user (reflected as PR:L). The specific trigger is executing script that reads non-ASCII header values via Headers get(), entries(), values(), or getSetCookie(), or returning non-ASCII headers from a fetch() endpoint. Limiting factors: if scripting is disabled or query access is restricted to fully trusted principals, exploitation is not possible; no victim user interaction is needed (UI:N), and impact is confined to availability (server process abort) with no data exposure or modification.

This is a medium-to-high severity availability-only flaw, not a top-tier emergency. The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 7.1) is internally consistent with the description: network-reachable, low complexity, but requiring low-privilege authentication (PR:L) and yielding only availability impact (VA:H) with no confidentiality or integrity loss (VC:N/VI:N) and no scope change. CWE-248 (uncaught exception) matches the 'aborting the server process' crash behavior. No EPSS score, KEV listing, or POC was provided, so exploitation likelihood cannot be quantified from the input; per the data this is 'no public exploit identified at time of analysis.' The key mitigating signals are that the attacker must be a query-capable (authenticated) user AND the embedded-JavaScript scripting feature must be enabled - a non-default, security-sensitive configuration. This substantially narrows the real exploitation population versus a raw AV:N 'network' reading. Bottom line: a legitimate but bounded priority - patch in environments that enable scripting and expose query access to semi-trusted users; lower urgency where scripting is disabled or query access is tightly restricted. No conflicting signals in the data, but EPSS/KEV/POC are simply absent rather than confirmed-negative.

An authenticated user with query privileges on a SurrealDB instance that has embedded JavaScript scripting enabled submits a query containing a script that calls Headers.get()/entries()/values()/getSetCookie() or returns a fetch() response whose headers contain non-ASCII values. Reading those non-ASCII header values triggers an uncaught exception that aborts the server process, taking down the database for all users. No public exploit code was identified in the provided data, and no user interaction by a victim is required.