CVE-2026-63759
Received Received - Intake

SurrealDB Type Parser Recursion Depth Exhaustion

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63759
EUVD
EUVD-2026-45930

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.1.0 has a flaw in its type/kind parser that fails to limit recursion depth when processing deeply nested type annotations. Authenticated attackers can exploit this by sending queries with excessive nesting, causing the server to consume all available memory and crash.

Detection Guidance

Monitor SurrealDB server logs for crashes or memory exhaustion errors during query processing. Check for WebSocket messages containing deeply nested type annotations like array<option<array<option<...>>>>. Use system monitoring tools to detect sudden memory spikes or process terminations in SurrealDB instances.

Impact Analysis

This vulnerability allows authenticated attackers to crash the SurrealDB server by sending specially crafted queries. This results in a denial of service, making the database unavailable for all users until the server is restarted.

Compliance Impact

This vulnerability primarily impacts availability by causing server crashes through memory exhaustion, which could lead to service disruptions. For GDPR, this may affect the right to uninterrupted service under data availability principles. For HIPAA, it could disrupt access to protected health information, potentially violating Security Rule requirements for timely access.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later to apply the recursion limit fix. Restrict untrusted users from executing arbitrary queries using the --deny-arbitrary-query flag. Disable untrusted access to the WebSocket /rpc endpoint if possible. Monitor for suspicious query patterns involving nested type annotations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart