SurrealDB versions 3.1.0 through 3.2.x contain an unbounded buffering bug in the Surrealism module output handling. This flaw allows the capture of arbitrarily large amounts of stdout or stderr data without line‑breaks, draining host RAM and eventually crashing the SurrealDB server. The issue is a classic memory exhaustion problem (CWE‑770) that results in denial of service for all namespaces and databases on the affected server.

The vulnerable components are the SurrealDB database and the Surrealism Runtime module. Versions 3.1.0 up to and including 3.2.x are affected; upgrading version 3.3.0 or later removes the unbounded output buffering logic. Both components share the same runtime process, so a single corrupted module can bring the entire database instance down.

The CVSS score of 6.9 indicates moderate severity. Because the EPSS score is unavailable, the probability of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires Owner‑level privileges to install a malicious Surrealism module, meaning an attacker must compromise a trusted user or achieve privilege elevation within the database. Once triggered, the server is crashed and all services are rendered unavailable.