SurrealDB CVE-2026-63747

The attacker only needs network reachability to the WebSocket /rpc endpoint and must send an RPC 'use' call that sets the 'db' field while no namespace ('ns') has been selected on the session. No credentials, token, prior signin, session state, or --allow-guests flag is required, because 'use' is dispatched before authentication and the default per-method capability check passes for guest callers. Limiting factors are minimal: exploitation depends only on the /rpc endpoint being network-accessible to the attacker, and is fixed in 3.1.0+, so patched or network-isolated deployments are not exploitable. Impact is confined to availability (process crash) - there is no path to data disclosure or code execution.

This is a genuinely high-priority DoS. All exploitation signals align: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VA:H, base 8.7) indicates a network-reachable, low-complexity, unauthenticated attack with high availability impact and no confidentiality or integrity impact. The GHSA advisory confirms the code path is reachable pre-auth with no --allow-guests flag needed, which matches the PR:N metric - a rare case where description text and CVSS agree fully. Impact is limited strictly to availability: there is no data exposure or code execution, so the ceiling is service outage, not compromise. No EPSS score, KEV listing, or SSVC decision was supplied in the input, and no public PoC is referenced, so real-world exploitation volume is unquantified; however, the triviality (a single crafted message crashes the process) means an exploit is easy to reproduce from the advisory. Net: real, exploitable, unauthenticated outage risk that warrants prompt patching, tempered by the fact that it is 'only' DoS.

An attacker who can reach a SurrealDB server's /rpc WebSocket endpoint opens a connection and, without authenticating, sends a single RPC 'use' message setting db to any value while omitting the namespace (e.g. use { db: "x" }). The server hits the .expect() and, because it is built with panic = 'abort', the entire process terminates, dropping all connections and taking the database offline. No public PoC is referenced, but the advisory describes the exact triggering payload, making reproduction trivial.