SurrealDB versions prior to 3.1.0 fail to enforce the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit on anonymous /sql WebSocket connections, a failure that falls under CWE-770, allowing an attacker to send arbitrarily large frames that are buffered without bound in the per‑connection read buffer. This causes a gradual, unmeasured increase in memory consumption until the database process can no longer allocate memory, leading to the /sql service becoming unresponsive. The vulnerability’s impact is thus a denial of service that can affect any client that relies on the /sql endpoint, including external applications and internal services.

All SurrealDB deployments running a version younger than 3.1.0 that expose the /sql WebSocket interface without requiring authentication are affected. This includes both community‑supported and enterprise distributions. Any installation that allows anonymous WebSocket connections to /sql is vulnerable until it is upgraded or the endpoint is secured via authentication or disabling.

The CVSS score of 6.9 indicates a moderate severity risk, while an EPSS score of less than 1% points to a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can exploit this remotely by establishing WebSocket connections to the /sql endpoint from any network location that can reach the database, sending large frames, and repeating the process across multiple concurrent connections until the target’s memory is exhausted. Successful exploitation will degrade or crash the /sql service, potentially impacting all applications dependent on that interface.