CVE-2026-63737
Received Received - Intake

SurrealDB Pre-1.3.5 DoS via Operator Chain Exploitation

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63737
EUVD
EUVD-2026-45908

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in SurrealDB versions before 3.1.5. Authenticated users can crash the server by submitting queries with long chains of operators that create unbounded expression trees. This causes a stack overflow during query processing, leading to process termination.

Detection Guidance

Monitor SurrealDB server logs for crashes or stack overflow errors during query processing. Check for queries with unusually long chains of operators, such as excessive '+' or other operator repetitions. Use network monitoring tools to detect repeated large query submissions to the /rpc or /sql endpoints.

Impact Analysis

The vulnerability allows authenticated attackers to crash the SurrealDB server, disrupting all databases and namespaces on the instance until the server is manually restarted. This results in downtime and loss of service availability for all users.

Compliance Impact

This vulnerability primarily impacts availability by allowing authenticated users to crash the SurrealDB server through denial of service attacks. For compliance standards like GDPR and HIPAA, which require data availability and integrity, this could lead to service disruptions affecting data access and processing. However, the vulnerability does not directly compromise confidentiality or integrity of stored data.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.5 or later to apply the patch. If upgrading is not possible, restrict untrusted users from executing arbitrary queries and limit access to the WebSocket /rpc endpoint. Configure the SURREAL_MAX_EXPRESSION_PARSING_DEPTH environment variable to a lower value if needed. Consider running SurrealDB under an orchestrator that restarts the process on failure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63737. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart