SurrealDB versions prior to 1.1.1 contain a logic flaw that allows authorized clients to invoke custom parameters and functions at the root or namespace levels. When these invocations occur at unsupported levels, the server panics and crashes, resulting in a denial of service. The primary weakness is a failure to validate the scope of these invocations, which leads directly to a server crash. The impact is limited to availability, as the flaw does not expose data or modify it.

The vulnerability affects SurrealDB products from the vendor surrealdb. All releases before 1.1.1 are affected. No specific minor patches are listed beyond the major version threshold, so any build older than 1.1.1 should be considered vulnerable.

The CVSS score of 7.1 indicates a moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker have legitimate client credentials to send requests that invoke unsupported global parameters or functions, so legitimate authorization is a prerequisite. Given the low exploitation probability, the risk is mostly theoretical unless an attacker gains authorized access and intentionally triggers the crash.