The vulnerability lies in the SurrealML header parser; owner‑role users can cause a panic by uploading a malformed .surml file, which aborts the entire SurrealDB server and denies service to all databases. This is a classic unchecked input validation flaw (CWE‑20).

The affected product is SurrealDB; any instance running a version earlier than 3.2.0 is vulnerable.

The CVSS score of 6.9 categorises this as a medium‑severity DoS. The EPSS score of < 1% indicates a very low probability of exploitation, and it is not listed in CISA’s Known Exploited Vulnerabilities catalogue. Exploitation requires an authenticated user with Owner privileges to post a crafted SurrealML file to the /ml/import endpoint; the malicious input’s non‑numeric dimensions or other malformed header fields trigger an unchecked unwrap, causing an immediate crash.