Surrealism Runtime
Monthly
Memory exhaustion in SurrealDB 3.1.0 through 3.2.x lets a Surrealism module crash the entire server, denying service to every namespace and database it hosts. The flaw is that host-side buffering of module stdout/stderr output is unbounded and bypasses the configured per-module memory limit, so a module that writes output without newline characters grows the host buffer until memory is depleted. It is confirmed as a privilege-gated issue: an attacker must hold Owner-level rights to install the malicious module (CVSS vector PR:H), and no public exploit code or active exploitation has been identified at time of analysis; instances that do not use Surrealism modules are not exposed.
Memory exhaustion in SurrealDB 3.1.0 through 3.2.x lets a Surrealism module crash the entire server, denying service to every namespace and database it hosts. The flaw is that host-side buffering of module stdout/stderr output is unbounded and bypasses the configured per-module memory limit, so a module that writes output without newline characters grows the host buffer until memory is depleted. It is confirmed as a privilege-gated issue: an attacker must hold Owner-level rights to install the malicious module (CVSS vector PR:H), and no public exploit code or active exploitation has been identified at time of analysis; instances that do not use Surrealism modules are not exposed.