SurrealDB fails to enforce recursion depth limits in its type/kind parser when handling nested type annotations. When an authenticated user sends a query with deeply nested annotations, the parser consumes excessive memory, eventually crashing the server process. This results in a denial of service that disrupts availability for all users.

The vulnerability affects all SurrealDB deployments using versions prior to 3.1.0. Authentication is required to submit queries; therefore, only users with legitimate access to the database can leverage the flaw. Administrators should verify the current version against the vendor’s release history.

The CVSS score is 7.1, indicating a medium‑to‑high severity. The EPSS score is < 1%, suggesting a very low probability of exploitation, and KEV is not listed. An attacker who has authenticated database access can trigger the denial of service by constructing a query with a deeply nested type annotation, thereby exhausting memory resources.