SurrealDB versions before 1.1.0 allow a query deepness of SurrealQL statements to grow without limit. An attacker who has authorized access can issue a query with excessive nesting of IF, RELATE, or attribute access expressions. The engine will recurse internally until the stack overflows, causing the database server process to crash and the service to become unavailable. This flaw is a classic stack overflow violation of resource limits (CWE‑674). The flaw does not disclose data or enable code execution, but it does break the availability of the database for all users.

The product affected is SurrealDB, provided by surrealdb:surrealdb. All releases before 1.1.0 are vulnerable; versions 1.1.0 and later have the recursion depth enforcement that mitigates this issue.

The CVSS score of 7.1 indicates a high impact on availability, while the EPSS score of less than 1% suggests that exploitation remains rare but possible. The vulnerability is not yet listed in the CISA KEV catalog, indicating that no widespread exploitation has been observed. Attackers would need authenticated access to the database to submit the malicious query, so the risk is confined to environments where the attacker can authenticate or where the database is exposed to untrusted clients. Because an overflow leads only to a crash, the condition for exploitation is simple once authorization is achieved, and the attack can be replayed until mitigation is applied.