EUVD-2026-45931
GHSA-m464-hj36-96vx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated crash of the /rpc parser with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
AnalysisAI
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single WebSocket message by sending a deeply nested JSON payload to the /rpc endpoint. The value/JSON parser ignores the configured recursion depth limit for nested braces, brackets, and parentheses, so uncontrolled recursion (CWE-674) exhausts server memory and terminates the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the SurrealDB WebSocket /rpc endpoint (default RPC interface) on a version earlier than 3.1.0; the malicious input is a single deeply nested JSON payload using stacked {, [, or ( tokens routed through the value/JSON parser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent for a high-severity availability bug and nothing else. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a SurrealDB server's WebSocket /rpc port opens a connection and sends a single RPC message containing a JSON value nested thousands of levels deep (e.g. many stacked [ or { tokens). … |
| Remediation | Vendor-released patch: 3.1.0 - upgrade SurrealDB to 3.1.0 or later, which enforces the configured recursion depth limit in parse_value and parse_json (fix commit https://github.com/surrealdb/surrealdb/commit/1bd9826f477f4089134460dc5574b6f4e6916973 ). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately inventory all SurrealDB deployments to identify instances running versions before 3.1.0, assess their criticality to business operations, and implement temporary network-level mitigations including WAF rules to block deeply nested JSON structures and rate-limiting on WebSocket connections to the /rpc endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today