SurrealDB versions prior to 1.1.0 improperly parse the ID, DB, and NS HTTP headers when they contain special characters. The parsing error triggers an uncaught exception that causes the server to crash, resulting in a denial of service. This weakness is classified as an improper handling of errors or exceptions (CWE-248).

The vulnerable product is SurrealDB, any release before 1.1.0. The public REST API is susceptible. Based on the description, it is inferred that internal clients that send HTTP requests containing these headers may also be affected, but this is not explicitly confirmed in the advisory.

An attacker does not need authentication to exploit the flaw; they simply send a crafted HTTP request to the exposed API endpoint. The CVSS score of 8.7 indicates a high impact and a low requirement for access. The EPSS score of less than 1 % suggests that the probability of exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, if the service is reachable from the internet or an untrusted network, a single malformed request can bring the database down, disrupting availability for all users.