EUVD-2026-45921
GHSA-qg3v-r4m7-x5f5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible anonymous endpoint with no auth; availability impact is partial and requires sustained attacker bandwidth, so A:L; no C/I impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.
AnalysisAI
Pre-authentication memory amplification in SurrealDB before 3.1.0 allows unauthenticated network attackers to exhaust server memory by streaming oversized WebSocket frames to the /sql endpoint, which fails to enforce the operator-configured SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit before buffering incoming bytes. The /sql WebSocket upgrade handler accepts anonymous connections and accumulates up to 16 MiB per frame and 64 MiB per reassembled message in per-connection read buffers - the full WebSocket library default - before the authentication check (check_anon) can reject the payload, meaning memory cost is incurred regardless of whether the caller holds any SurrealQL permissions. No public exploit has been identified at time of analysis, but the unauthenticated network-accessible attack surface requires no special prerequisites beyond network connectivity and sustained bandwidth.
Technical ContextAI
SurrealDB is a multi-model database server written in Rust (rust/surrealdb package) that exposes SurrealQL query endpoints over both HTTP and WebSocket. The vulnerable component is the /sql WebSocket upgrade handler, which accepts anonymous connections and routes them through the WebSocket protocol layer before invoking check_anon for authentication. The root cause (CWE-770: Allocation of Resources Without Limits or Throttling) is that the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE environment variable - intended to cap per-connection frame sizes - was never propagated to the WebSocket protocol layer in this code path. Consequently, the underlying WebSocket library defaults (16 MiB per frame, 64 MiB per reassembled message) govern buffer allocation. A secondary defect - that --deny-http sql and --deny-arbitrary-query * operator flags were silently ignored for authenticated callers on this same upgrade path - is a configuration-correctness issue that does not grant new permissions and is lower severity. Affected package: rust/surrealdb < 3.1.0 per GHSA-65rj-r9fh-jp2v.
RemediationAI
The primary fix is upgrading to SurrealDB 3.1.0 or later, which resolves both the size-limit bypass and the capability-check bypass by performing operator deny-flag checks before calling on_upgrade and applying the same per-connection frame size limits used by the /rpc endpoint. The fix commit is https://github.com/surrealdb/surrealdb/commit/899967e6a9cf064c88a4bc4b35ea7e2da28a6411, and the full advisory is GHSA-65rj-r9fh-jp2v. For operators unable to upgrade immediately, the vendor-endorsed workaround is to refuse GET /sql requests carrying an Upgrade: websocket header at a reverse proxy (e.g., nginx location block with a deny for websocket upgrades); this eliminates the attack surface entirely but disables WebSocket-mode SurrealQL querying on /sql, forcing clients to use the HTTP or /rpc WebSocket path instead. Alternatively, applying per-connection frame size limits at the reverse proxy layer preserves WebSocket functionality while bounding the memory a single connection can consume, though this is a partial mitigation if the proxy's own frame-size defaults remain generous.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today