CVE-2026-63760
Received Received - Intake

SurrealDB Memory Exhaustion via Nested JSON Parsing

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63760
EUVD
EUVD-2026-45931

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.1.0 has a flaw in its JSON parser where it fails to enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. This allows unauthenticated attackers to send deeply nested JSON payloads to the WebSocket /rpc endpoint, causing the server to exhaust memory and crash.

Detection Guidance

Monitor SurrealDB server logs for crashes or memory exhaustion events during JSON parsing. Check for unusually high memory usage or process termination logs. Use network monitoring tools to detect excessive WebSocket /rpc endpoint traffic with deeply nested payloads.

Impact Analysis

This vulnerability can lead to a Denial of Service (DoS) where an attacker crashes the SurrealDB server by sending a single malicious WebSocket message. This disrupts service availability for all users relying on the database, without requiring any authentication or privileges.

Compliance Impact

This vulnerability primarily impacts availability, which could lead to service disruptions. For GDPR, this may affect data accessibility rights. For HIPAA, it could disrupt access to protected health information. Compliance may be impacted if service outages violate availability requirements.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later to patch the vulnerability. If immediate upgrade is not possible, restrict network access to the WebSocket /rpc endpoint to prevent unauthenticated access. Implement rate limiting or payload size restrictions on the endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart