CVE-2026-63747
Received Received - Intake

SurrealDB RPC DoS via Missing Namespace in WebSocket Message

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63747
EUVD
EUVD-2026-45918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in SurrealDB versions before 3.1.0. It occurs when the database is set without a namespace, causing the server to crash upon receiving a malformed WebSocket message at the /rpc endpoint. Unauthenticated attackers can exploit this to crash the server process.

Detection Guidance

Monitor SurrealDB server logs for crashes or panics after receiving WebSocket messages to the /rpc endpoint. Check for malformed 'use' requests without a namespace. Use network traffic analysis tools like Wireshark to inspect WebSocket traffic for suspicious RPC calls targeting /rpc.

Impact Analysis

The vulnerability allows unauthenticated remote attackers to crash the SurrealDB server by sending a single malicious WebSocket message. This results in complete server unavailability, though no data loss or confidentiality issues occur.

Compliance Impact

This vulnerability primarily causes denial of service by crashing the SurrealDB server, which could lead to temporary unavailability of data processing systems. For GDPR, this may impact availability of personal data processing, potentially violating Article 32 requirements for resilience. For HIPAA, it could disrupt access to protected health information, affecting the availability requirement under the Security Rule.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later. If upgrading is not possible, restrict network access to the /rpc endpoint using firewalls or network segmentation. Use a process supervisor like systemd or supervisord to automatically restart the server on crash.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart