SurrealDB Stack Overflow via Recursive UPDATE Statements

Executive Summary

SurrealDB before version 3.3.0 has an unbounded recursion flaw in its value serialization process. This allows authenticated users to crash the entire SurrealDB process by creating deeply nested values through UPDATE statements. The nested values trigger stack overflows during SELECT, EXPORT, or other operations, causing persistent denial of service for all tenants.

Useful 0 Not Useful 0

Detection Guidance

Monitor SurrealDB process crashes or unresponsiveness during SELECT, EXPORT, or UPDATE operations. Check for deeply nested array structures in stored data by querying the database for records with excessive nesting levels.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause complete service disruption by crashing the SurrealDB server. All tenants on the affected instance lose access until the problematic record is manually removed. The attack requires only basic user privileges and can be triggered repeatedly.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later immediately. If upgrading is not possible, manually inspect and remove deeply nested values from storage to prevent persistent DoS. Implement input validation to limit nesting depth in UPDATE statements.

Useful 0 Not Useful 0