EUVD-2026-45931
GHSA-m464-hj36-96vx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated crash of the /rpc parser with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
AnalysisAI
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single WebSocket message by sending a deeply nested JSON payload to the /rpc endpoint. The value/JSON parser ignores the configured recursion depth limit for nested braces, brackets, and parentheses, so uncontrolled recursion (CWE-674) exhausts server memory and terminates the process. This is an incomplete-fix regression of GHSA-6r8p-hpg7-825g, which patched the same bug class in the expression parser but missed the value/JSON code path; no public exploit identified at time of analysis, though the trigger is trivially reproducible from the advisory.
Technical ContextAI
SurrealDB is a multi-model (document/graph/relational) database written in Rust that exposes a JSON-RPC API over WebSocket at /rpc. Its query pipeline includes several parsers; the expression parser correctly bounds recursion when it encounters opening tokens ({, [, (), but the separate value parser (parse_value) and JSON parser (parse_json) failed to apply the same configured depth limit. The root cause is CWE-674 (Uncontrolled Recursion): each additional level of nesting drives another recursive descent call, so an attacker-controlled nesting depth translates directly into unbounded stack/heap growth until the process is OOM-killed or aborts. Because the flaw is in the parser itself - before any authentication, query planning, or permission checks - it is reachable purely by feeding malformed structured input.
RemediationAI
Vendor-released patch: 3.1.0 - upgrade SurrealDB to 3.1.0 or later, which enforces the configured recursion depth limit in parse_value and parse_json (fix commit https://github.com/surrealdb/surrealdb/commit/1bd9826f477f4089134460dc5574b6f4e6916973 ). If immediate upgrade is not possible, apply the vendor workaround of restricting network access to the WebSocket /rpc endpoint to trusted clients only - for example placing the database behind a firewall, VPN, or reverse proxy allowlist so untrusted hosts cannot reach /rpc; the trade-off is that any legitimate client that connects directly over the network must be enumerated and permitted, which complicates broadly-accessible or multi-tenant deployments. Refer to the advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq for details.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that fi
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today