EUVD-2026-45908
GHSA-q3vg-g3wv-mfgg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query interface (AV:N), reliable low-complexity trigger (AC:L), requires an authenticated query-execution user (PR:L), no interaction (UI:N), and pure availability impact (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.
AnalysisAI
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
Technical ContextAI
SurrealDB is a Rust-based multi-model database that parses SurrealQL queries using a Pratt (operator-precedence) parser. The flaw is CWE-674 (Uncontrolled Recursion). A long chain of binary operators is parsed into an expression tree that is only one level deep per operator but arbitrarily long along the spine; because the chain is flat and the Pratt parser appends to it iteratively, SurrealDB's existing query- and object-recursion limits never trigger, so the structure grows with query length. The tree is later traversed recursively - one stack frame per node - when it is dropped, formatted, or lowered for execution, and a sufficiently long chain exhausts the thread stack. The vulnerable code lives in the rust/surrealdb crate for versions >= 3.0.0 and < 3.1.5.
RemediationAI
Vendor-released patch: upgrade to SurrealDB 3.1.5 or later, which adds a dedicated expression-depth budget (expr_recursion_limit) sourced from max_expression_parsing_depth (default 128, configurable via SURREAL_MAX_EXPRESSION_PARSING_DEPTH) that rejects over-deep operator chains with a syntax error before a stack-overflowing tree is built, while exempting re-parse of already-validated stored data so existing deep expressions still load. If you cannot patch immediately, restrict untrusted users from running arbitrary queries using the --deny-arbitrary-query capability flag for the relevant user classes (guest, record, or system) - note this blocks legitimate ad-hoc queries for those classes. Also restrict access to the WebSocket /rpc endpoint, which accepts larger request bodies than HTTP /sql; the /sql endpoint's 1 MiB body limit lowers achievable operator depth but does not by itself guarantee the stack cannot be exhausted. Finally, run SurrealDB under an orchestrator or process manager with automatic restart (Kubernetes, systemd Restart=on-failure, or a Docker restart policy) to minimize downtime - this limits outage duration but does not prevent the crash. See GHSA-jv2j-mqmw-xvv5 for details.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that fi
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today