EUVD-2026-45918
GHSA-j7ww-7h79-mmf6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-message crash over the network gives AV:N/AC:L/PR:N/UI:N; impact is process termination only, so C:N/I:N/A:H with no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.
AnalysisAI
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process with a single WebSocket message to the /rpc endpoint. Sending an RPC 'use' call that sets a database (db) without first selecting a namespace triggers a Rust panic on an .expect() call; because surrealdb-core is compiled with panic = 'abort', the panic aborts the whole process rather than the connection. The vulnerability (CVSS 4.0 8.7, VulnCheck/GHSA-wjjj-24cx-f28g) requires no credentials, token, or --allow-guests flag, and no public exploit has been identified at time of analysis.
Technical ContextAI
SurrealDB is a Rust-based multi-model database that exposes a JSON-RPC API over WebSocket at /rpc. Client sessions establish context via a 'use' call that selects a namespace (ns) and database (db). The bug is a CWE-248 uncaught-exception (unhandled Rust panic): the 'use' handler assumes a namespace is already set when a db is provided and calls .expect("namespace should be set"), which panics if that invariant is violated. Rust normally unwinds a panic per-task, but surrealdb-core is built with panic = 'abort', so any panic terminates the OS process. Critically, 'use' is dispatched before authentication (it is callable prior to signin), and the default per-method capability check passes for anonymous/guest callers, so the vulnerable code path is reachable pre-auth on a default deployment.
RemediationAI
Vendor-released patch: upgrade to SurrealDB 3.1.0 or later, which replaces the panic with a typed 'invalid_params' error response when db is set on a session that has no ns (fix commit https://github.com/surrealdb/surrealdb/commit/1537ec4fbd789c61a5b43b648a854577dbe31a34; advisory https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wjjj-24cx-f28g). If you cannot upgrade immediately, apply the vendor-recommended workarounds: restrict network access to the /rpc endpoint so only trusted clients can reach it (via firewall rules, a reverse proxy, or network segmentation - trade-off: legitimate remote clients must be explicitly allowlisted), and run SurrealDB under a process supervisor (systemd, Docker restart policy, or similar) that automatically restarts the process on crash (trade-off: this only reduces downtime per crash and does not prevent repeated aborts, so an attacker can still cause a sustained crash loop).
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that fi
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today