EUVD-2026-45930
GHSA-56pq-53x9-mxc4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query endpoint (AV:N/AC:L), requires an authenticated query user (PR:L), no user interaction; impact is availability-only crash (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.
AnalysisAI
Denial of service in SurrealDB before 3.1.0 lets an authenticated user with query-execution privileges crash the server with a single WebSocket message. The type/kind parser fails to enforce the configured recursion depth limit when parsing deeply nested type annotations (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with query-execution privileges (CVSS PR:L) and network reachability to a query endpoint - realistically the WebSocket /rpc endpoint, which imposes no body-size cap. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VA:H, VC:N/VI:N) is internally consistent with the description: network-reachable, low complexity, requires low privileges (an authenticated query user), and impacts availability only - no confidentiality or integrity loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a valid low-privilege account with query-execution rights connects to the SurrealDB WebSocket /rpc endpoint and sends one query containing a type annotation nested hundreds or thousands of levels deep, such as a cast to array<option<array<option<...>>>>. The kind parser recurses without bound, memory is exhausted, and the server process crashes, taking down the database for all tenants. … |
| Remediation | Upgrade to SurrealDB 3.1.0 or later, which wraps parse_concrete_kind and the OPTION<...> arm of parse_inner_kind with the enter_object_recursion! … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SurrealDB deployments and identify which run versions prior to 3.1.0, then enumerate all user accounts and service principals with query-execution privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today