SurrealDB Memory Exhaustion via Unbounded WebSocket Frames

Executive Summary

CVE-2026-63750 is a memory amplification vulnerability in SurrealDB versions before 3.1.0. It occurs because the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not enforced for anonymous WebSocket connections to the /sql endpoint. Attackers can send WebSocket frames larger than the configured limit across multiple concurrent connections, consuming excessive memory and degrading the availability of the /sql endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor SurrealDB instances for unusually high memory usage or degraded performance on the /sql WebSocket endpoint. Check SurrealDB logs for large WebSocket frame sizes or frequent connections to /sql. Use network monitoring tools like tcpdump or Wireshark to inspect WebSocket traffic for frames exceeding configured size limits.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to excessive memory consumption and reduced availability of the /sql endpoint. In severe cases, it may trigger out-of-memory conditions on constrained systems, causing service degradation or crashes. Attackers could exploit this to degrade performance for legitimate users or launch denial-of-service attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by allowing excessive memory consumption through unbounded WebSocket frames. While not directly violating GDPR or HIPAA, it could indirectly affect compliance by degrading system performance or causing outages that disrupt access to personal or health data, potentially violating availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SurrealDB to version 3.1.0 or later. As a temporary workaround, block WebSocket upgrade requests to /sql at a reverse proxy or apply per-connection frame size limits there. Restrict access to the /sql endpoint if not required.

Useful 0 Not Useful 0