CVE-2026-63734
Received Received - Intake

SurrealML Header Parser DoS in SurrealDB

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other malformed header fields that trigger unchecked unwrap calls, causing a panic that aborts the entire server process and denies service to all databases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63734
EUVD
EUVD-2026-45905

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63734 is a denial of service vulnerability in SurrealDB versions before 3.2.0. It involves improper input validation in the SurrealML header parser. Authenticated users with the Owner role can crash the server by uploading a malformed .surml file to the /ml/import endpoint. The issue occurs when non-numeric input-dimensions or other malformed header fields trigger unchecked unwrap calls, causing a panic that aborts the entire server process.

Detection Guidance

Monitor SurrealDB server logs for crashes or panics, particularly after file uploads to /ml/import. Check for malformed .surml files with non-numeric input-dimensions or invalid header fields. Use network monitoring tools to detect unusual traffic patterns targeting the /ml/import endpoint.

Impact Analysis

This vulnerability allows authenticated Owner-role users to crash the SurrealDB server, denying service to all databases until a restart. The impact is limited to availability, as the crash happens before the model is stored. Users without the Owner role cannot exploit this vulnerability.

Compliance Impact

This vulnerability primarily impacts availability by crashing the SurrealDB server, which could lead to temporary loss of database access. For GDPR, this may affect data availability rights under Article 12-17. For HIPAA, it could disrupt access to protected health information, potentially violating the Security Rule's availability requirements. However, the vulnerability does not directly expose or leak data, so confidentiality and integrity impacts are minimal.

Mitigation Strategies

Upgrade SurrealDB to version 3.2.0 or later. Disable the ML feature if not needed. Restrict Owner role assignments to trusted users only. Implement a process supervisor to auto-restart the server in case of crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart