SurrealDB CVE-2026-121423

Requires an authenticated SurrealDB account with ordinary table write AND read privileges - a scoped/record user with table write suffices (CVSS PR:L); it is not remote-unauthenticated. No non-default configuration is required: the advisory states default deployments are affected. The attacker must be able to issue write statements (UPDATE/CREATE) to accumulate a deeply nested value and then any read path (SELECT, INFO, or admin EXPORT) to trigger a sink. Limiting factors that temper real-world risk: valid credentials with write+read are mandatory; the attack needs roughly 10,000+ separate requests to build sufficient nesting depth to overflow the ~8 MiB thread stack; and impact is confined to availability (process abort / DoS) with no confidentiality or integrity effect. Aggravating factor: once written, the poisoned record causes persistent DoS surviving restart, re-crashing on every read/EXPORT until purged out-of-band.

Signals are internally consistent and point to a real but bounded priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the GHSA advisory agree: this is a network-reachable, low-complexity, authenticated (PR:L) flaw whose only impact is availability (VA:H; VC:N/VI:N) - a denial of service, not data compromise or code execution. The vuln.today Decision label is 'this_week' (not act_now/emergency). KEV status is not listed in the input, so there is no confirmed active exploitation; EPSS is not provided, so exploitation probability cannot be quantified from this data. A documented proof of concept (the SQL accumulation steps) is published in the GHSA advisory, which raises practical exploitability above a theoretical issue. The notable aggravating factor beyond the raw 7.1 score is persistence and blast radius: the deeply nested value survives the write and re-crashes the whole surreald process (all namespaces/databases/tenants) on every subsequent SELECT/EXPORT until the poisoned record is purged out-of-band, and panic='abort' makes each overflow an unconditional process kill. Net: a credible this-week-tier, authenticated, persistent multi-tenant DoS - a genuine operational risk for anyone running SurrealDB before 3.3.0 with untrusted or scoped users, but not a critical RCE-class emergency. Missing data to flag: no EPSS score and no KEV entry in the input, so widespread-exploitation likelihood is unmeasured.

An authenticated SurrealDB user holding only ordinary table write+read (even a scoped/record user) creates a record and repeatedly issues UPDATE statements wrapping a stored array inside itself (UPDATE deep:1 SET v=[v]) across ~10,000+ separate requests, each adding one nesting level and staying under all per-parse caps. A single subsequent SELECT or EXPORT then walks the value through a depth-unguarded recursion sink, overflowing the thread stack and aborting the entire surreald process for every tenant. A demonstrative PoC (the exact SQL sequence) is published in the GHSA-rpmq-gq3f-h6jg advisory; it is not verified as compiled working exploit code but is trivially scriptable.