This vulnerability in SurrealDB versions prior to 3.3.0 allows query-capable users to trigger a denial of service by reading non‑ASCII header values within embedded JavaScript. headers API or fetch endpoints, an attacker can cause the server process to crash. The weakness is an incorrect conversion or interpretation of characters, identified as CWE‑248. A crash stops the server, impacting availability of all services that rely on the database.

The affected product is SurrealDB, provided by surrealdb. Versions earlier than 3.3.0 are impacted. No specific minor or patch releases within that range are documented, so all releases below 3.3.0 should be considered vulnerable.

The advisory assigns a CVSS score of 7.1, indicating high severity for a denial of service. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog at present. Attackers need only a scripting‑enabled environment and the ability to send custom HTTP headers to the database server; they can then use the headers API or fetching mechanisms to trigger the crash. Because the flaw resides in server‑side JavaScript handling of header values, it is likely exploitable from external clients that can construct HTTP requests to the database.