EUVD-2026-45930
GHSA-56pq-53x9-mxc4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query endpoint (AV:N/AC:L), requires an authenticated query user (PR:L), no user interaction; impact is availability-only crash (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.
AnalysisAI
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. array<option<array<option<...>>>>), driving uncontrolled recursion that exhausts server memory and terminates the process. No public exploit identified at time of analysis and not listed in CISA KEV, but the flaw is trivially triggerable and is an incomplete fix of a previously patched bug class (GHSA-6r8p-hpg7-825g).
Technical ContextAI
SurrealDB is a Rust-based multi-model database that accepts SurrealQL queries over a WebSocket /rpc endpoint and an HTTP /sql endpoint. The root cause is CWE-674 (uncontrolled recursion): the type/kind parser recurses through the cycle parse_concrete_kind → parse_inner_kind → parse_inner_single_kind → parse_concrete_kind without applying the object_recursion_limit (default 100) that the expression parser already enforced. Because nested type annotations such as array<option<array<...>>> map directly onto this recursive descent, each nesting level consumes stack/heap until memory is exhausted. The affected component is the rust/surrealdb crate at versions below 3.1.0; CPE data was not provided, so affected identification relies on the vendor GHSA advisory and package range.
RemediationAI
Upgrade to SurrealDB 3.1.0 or later, which wraps parse_concrete_kind and the OPTION<...> arm of parse_inner_kind with the enter_object_recursion! guard to bound recursion at the configured object_recursion_limit (default 100); the fix is in commit 61d509b766afdf67cc26d8203fd7dc583c8d77aa (Vendor-released patch: 3.1.0). If immediate patching is not possible, restrict untrusted query execution using the --deny-arbitrary-query capability flag for the guest, record, and system user classes, accepting that this blocks legitimate ad-hoc queries for those classes. Alternatively, disable untrusted access to the WebSocket /rpc endpoint entirely, or route untrusted traffic only through the HTTP /sql endpoint, whose 1 MiB request body limit constrains nesting depth below the level needed to trigger OOM - at the cost of losing WebSocket RPC functionality for those users. See the advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q8qp-67f9-wr3f.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today