EUVD-2026-45925
GHSA-grg2-m369-7vhm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity attack needing only low-privilege select access (PR:L); pure availability DoS (A:H, C/I:N), and S:C because a low-privilege user impacts writes for root and all other users.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write operations on a table for any user, including root, by registering a LIVE query that triggers evaluation errors until the query is killed or the session ends.
AnalysisAI
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated SurrealDB session with 'select' permission on the target table (PR:L) and the ability to register a LIVE query - no other table permission, no user interaction, and no non-default configuration are needed, since LIVE queries are a core feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) correctly frames this as a network-reachable, low-complexity, low-privilege attack with high availability impact and no confidentiality or integrity impact - a pure DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | In a multi-tenant SurrealDB deployment, a low-privilege user with only select permission on the 'orders' table opens a session and registers LIVE SELECT * FROM orders WHERE string::trim(deny), whose WHERE clause throws a type error on every evaluation. From that moment, all CREATE/UPDATE/DELETE operations on 'orders' - including those performed by the root user or backend services - fail and roll back until the malicious LIVE query is killed or the attacker's session ends, effectively freezing writes to the table. … |
| Remediation | Vendor-released patch: upgrade to SurrealDB 3.1.0 or later, which decouples LIVE query evaluation errors from the source transaction (an erroring WHERE clause now yields an Action::Error notification to the subscriber and returns Ok(()) so the triggering write proceeds) and defers that error notification until after the LIVE subscription's PERMISSIONS clause is evaluated to close an information-disclosure side channel. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SurrealDB deployments and identify whether users with select-only database permissions exist in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today