SurrealDB CVE-2026-109339

Exploitation requires an Owner-privileged actor (PR:H) who can install a Surrealism module, and that module must write stdout/stderr output without newline characters so the host buffers it unbounded, bypassing the configured per-module memory limit. The deployment must be running an affected SurrealDB version (3.1.0 up to, but not including, 3.3.0) with the Surrealism runtime/module feature in use - instances that do not use Surrealism modules are not exposed. The key limiting factor is the Owner-level privilege requirement: this is not remotely reachable by unauthenticated or low-privileged users, so realistic risk is confined to malicious insiders, compromised Owner credentials, or untrusted-module scenarios. No end-user interaction is required once the module is installed.

This is a moderate, privilege-gated denial-of-service issue rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VA:H, confidentiality and integrity N) is internally consistent with the description: the attack is network-reachable and low-complexity, but it requires PR:H - specifically an Owner-level actor capable of installing a Surrealism module - and the only impact is availability (host memory exhaustion / server crash). No EPSS score, CISA KEV entry, or POC was provided in the input, so there is no signal of active or probable exploitation; the PR:H requirement makes mass, opportunistic exploitation unlikely and points toward an insider or compromised-Owner-credential scenario. The high privilege barrier is the decisive mitigating factor - an Owner who installs a malicious module already holds broad control over the namespace/database, which limits the marginal value of this specific bug. Note the signals do not conflict: moderate CVSS, no exploitation evidence, and high required privilege all align on 'real but not urgent.' The one escalating factor is blast radius: a single crash denies service across ALL namespaces and databases on the server, so in a shared multi-tenant deployment the impact of a trusted-but-malicious or compromised Owner is disproportionate.

An attacker who holds (or has compromised) SurrealDB Owner privileges installs a malicious Surrealism module that writes a continuous stream of stdout/stderr output without newline characters. Because the host buffers these lines unbounded and bypasses the configured module memory limit, host memory is steadily consumed until the server process crashes, denying service to every namespace and database. No public exploit or POC was identified in the provided data, and exploitation requires the Owner-level install step.