Description
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
Published: 2026-07-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

SurrealDB before version 3.1.0 does not enforce its configured recursion depth limit while parsing nested JSON structures. The flaw allows unauthenticated attackers to send deeply nested payloads to the WebSocket /rpc endpoint, causing the server to exhaust memory and crash. This results in a denial of service and correlates with CWE‑674, uncontrolled recursion.

Affected Systems

All SurrealDB installations running any release older than 3.1.0, especially those exposing the /rpc WebSocket interface to external clients.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers only require unauthenticated network access to the RPC interface, so the threat is accessible to anyone that can reach the endpoint.

Generated by OpenCVE AI on July 30, 2026 at 19:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SurrealDB to version 3.1.0 or later, which enforces the recursion depth limit.
  • If a patch cannot be applied immediately, consider blocking or rate‑limiting access to the /rpc WebSocket endpoint to mitigate abuse of nested payloads.
  • Monitor server memory usage and set alerts for anomalous consumption that could indicate a successful denial‑of‑service attempt.

Generated by OpenCVE AI on July 30, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Surrealdb
Surrealdb surrealdb
Vendors & Products Surrealdb
Surrealdb surrealdb

Mon, 20 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
Title SurrealDB before 3.1.0 Denial of Service via JSON Parser
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Surrealdb Surrealdb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-28T01:05:50.760Z

Reserved: 2026-07-18T12:30:08.354Z

Link: CVE-2026-63760

cve-icon Vulnrichment

Updated: 2026-07-20T12:51:51.461Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:45:06Z

Weaknesses