EUVD-2026-45908
GHSA-q3vg-g3wv-mfgg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with query-execution rights
-
DeliveryCraft query with tens of thousands of chained operators
-
ExploitSubmit via WebSocket /rpc endpoint
-
ExecutionParser builds unbounded expression tree
-
PersistRecursive walk overflows thread stack
-
ImpactProcess aborts, all databases denied service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires an authenticated session with query-execution privileges (CVSS PR:L) on the SurrealDB instance - no unauthenticated path is indicated. The attacker must be able to submit a raw SurrealQL query containing a very long flat chain of operators (on the order of tens of thousands of terms), most effectively via the WebSocket /rpc endpoint, which accepts larger request bodies than the HTTP /sql endpoint. No non-default configuration is needed and the crash works against default settings on affected versions (3.0.0 through 3.1.4). Limiting factors: valid credentials with query rights are mandatory; the /sql endpoint's 1 MiB body cap reduces (but does not eliminate) achievable operator depth; and deployments that deny arbitrary queries to untrusted user classes are protected. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low attack complexity, requires low-level privileges (PR:L, i.e. an authenticated query-execution user), no user interaction, and pure availability impact with no confidentiality or integrity loss. This is a genuine but bounded risk: it is trivially reliable and needs no non-default configuration, but it requires valid authentication and query-execution rights, so it is primarily an insider or credentialed-attacker threat rather than an unauthenticated internet-facing one. No KEV listing and no known POC reduce urgency relative to actively exploited flaws, and no EPSS value was provided in the input. The main aggravating factor is blast radius - one query aborts the whole process, taking down all namespaces and databases on the instance. Net priority: patch promptly for multi-tenant or untrusted-user deployments, moderate priority for single-trusted-tenant setups. |
| Exploit ScenarioDerived | An authenticated user with query-execution privileges - or an attacker who has phished or otherwise obtained such credentials - connects to the SurrealDB WebSocket /rpc endpoint and submits a single SurrealQL query containing tens of thousands of chained operators. The server builds an unbounded expression tree and overflows its thread stack while processing it, aborting the entire process and denying service to all databases on that instance. No public POC is identified, but the technique is described plainly enough in the advisory to be reproduced trivially. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire server process with a single crafted query. Submitting a flat operator chain of tens of thousands of terms (e.g. RETURN 1 + 1 + 1 + ...) builds an unbounded expression tree that overflows the thread stack when later walked recursively, aborting the process and denying service to every namespace and database on the instance. No public exploit identified at time of analysis; impact is availability-only with an EPSS-independent CVSS 4.0 score of 7.1.
RemediationAI
Vendor-released patch: upgrade to SurrealDB 3.1.5 or later, which adds a dedicated expression-depth budget (expr_recursion_limit) sourced from max_expression_parsing_depth (default 128, configurable via SURREAL_MAX_EXPRESSION_PARSING_DEPTH) that rejects over-deep operator chains with a syntax error before a stack-overflowing tree is built, while exempting re-parse of already-validated stored data so existing deep expressions still load. If you cannot patch immediately, restrict untrusted users from running arbitrary queries using the --deny-arbitrary-query capability flag for the relevant user classes (guest, record, or system) - note this blocks legitimate ad-hoc queries for those classes. Also restrict access to the WebSocket /rpc endpoint, which accepts larger request bodies than HTTP /sql; the /sql endpoint's 1 MiB body limit lowers achievable operator depth but does not by itself guarantee the stack cannot be exhausted. Finally, run SurrealDB under an orchestrator or process manager with automatic restart (Kubernetes, systemd Restart=on-failure, or a Docker restart policy) to minimize downtime - this limits outage duration but does not prevent the crash. See GHSA-jv2j-mqmw-xvv5 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SurrealDB is a Rust-based multi-model database that parses SurrealQL queries using a Pratt (operator-precedence) parser. The flaw is CWE-674 (Uncontrolled Recursion). A long chain of binary operators is parsed into an expression tree that is only one level deep per operator but arbitrarily long along the spine; because the chain is flat and the Pratt parser appends to it iteratively, SurrealDB's existing query- and object-recursion limits never trigger, so the structure grows with query length. The tree is later traversed recursively - one stack frame per node - when it is dropped, formatted, or lowered for execution, and a sufficiently long chain exhausts the thread stack. The vulnerable code lives in the rust/surrealdb crate for versions >= 3.0.0 and < 3.1.5.
Know when Surrealdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable query interface (AV:N), reliable low-complexity trigger (AC:L), requires an authenticated query-execution user (PR:L), no interaction (UI:N), and pure availability impact (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.
Executive ViewAI
SurrealDB versions before 3.1.5 contain a database-wide availability risk: any user with query-execution privileges can crash the entire server with a single malicious query, immediately blocking all applications dependent on that instance. While no public exploit code exists, the attack is trivial to execute and would interrupt all business operations relying on that database. With no patch currently available, immediate implementation of privilege restrictions is essential to prevent authorized users from triggering this vulnerability.
Restrict database query-execution privileges to only essential administrators with mandatory approval workflows; implement IP-based access controls and network segmentation limiting who can reach the SurrealDB query interface; enable detailed query logging and monitoring with alerts for abnormally large or complex queries; consider running SurrealDB instances in isolated containers with memory and CPU limits to minimize impact of any DoS attempt.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
SurrealDB versions before 3.3.0 fail to validate a caller's authorization level when the SurrealQL USE statement switche
Cross-tenant data access in SurrealDB before 3.3.0 allows an authenticated namespace- or database-level SYSTEM user to b
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB versions before 3.3.0 lets a query-capable authenticated user with embedded JavaScript sc
Authenticated SurrealDB record users can read field values that field-level SELECT permissions are meant to conceal on S
Exploit-DB