EUVD-2026-45925
GHSA-grg2-m369-7vhm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity attack needing only low-privilege select access (PR:L); pure availability DoS (A:H, C/I:N), and S:C because a low-privilege user impacts writes for root and all other users.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write operations on a table for any user, including root, by registering a LIVE query that triggers evaluation errors until the query is killed or the session ends.
AnalysisAI
Denial of service in SurrealDB before 3.1.0 allows an authenticated user holding only 'select' permission on a table to indefinitely block all CREATE, UPDATE, and DELETE operations on that table for every other user - including root. By registering a LIVE query whose WHERE clause deterministically throws an evaluation error (e.g. calling a typed SurrealQL function with a wrong-typed argument), the resulting error propagates into the write path and rolls back the triggering modification. No public exploit identified at time of analysis, but the technique is fully documented in the vendor's GHSA advisory.
Technical ContextAI
SurrealDB is a multi-model (document/graph/relational) database written in Rust that supports LIVE queries - persistent subscriptions that notify clients when records on a watched table change. When a write occurs, the engine evaluates each registered LIVE query's WHERE clause (lq_check) to decide whether to emit a notification. The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions): an error returned by the LIVE query's WHERE evaluation was not isolated from the source transaction, so the exception thrown inside the notification path propagated back to and aborted the user's write. An attacker weaponizes this by supplying a WHERE clause guaranteed to throw at evaluation time, such as passing a wrong-typed value into a strongly-typed function like string::trim(deny). Per the Rust crate metadata (rust/surrealdb), all versions < 3.1.0 are affected.
RemediationAI
Vendor-released patch: upgrade to SurrealDB 3.1.0 or later, which decouples LIVE query evaluation errors from the source transaction (an erroring WHERE clause now yields an Action::Error notification to the subscriber and returns Ok(()) so the triggering write proceeds) and defers that error notification until after the LIVE subscription's PERMISSIONS clause is evaluated to close an information-disclosure side channel. The fix corresponds to commits af835eb199ad2327a04c42101d11aff21fce7e47 and b29e03f0714d1c4ec091fc6f27f1edbe243b8aec. For users who cannot upgrade, the vendor-recommended workaround is to remove the 'select' permission on tables that must remain writeable, which prevents untrusted users from registering LIVE queries against them - at the cost of denying those users legitimate read access - or to gate LIVE query registration at the application layer, which requires application-side enforcement and does not protect direct database sessions. Reference the GHSA advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4v76-cw68-4vc9.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today