CVE-2026-63760
SurrealDB before 3.1.0 Denial of Service via JSON Parser
- State
- Published
- Severity
- 8.7 High
- Published
- Jul 20, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jul 18, 2026
Description
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
surrealdbsurrealdb |
|
References
- GitHub Security Advisory (GHSA-q729-696q-g9pq)vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.1.0 Denial of Service via JSON Parserthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.