CVE-2026-109339
Received Received - Intake

SurrealDB Memory Exhaustion via Malicious Module Output

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109339
EUVD
EUVD-2026-97641

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
surrealdb surrealdb 3.1.0
surrealdb surrealism-runtime 0.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SurrealDB versions 3.1.0 to 3.2.9 where the Surrealism module can bypass memory limits by writing continuous output without newlines. The server buffers this output in its own memory without a size limit, causing memory exhaustion and denial of service.

Detection Guidance

Check SurrealDB server version with 'surreal version' command. If using Surrealism modules, monitor server memory usage for unexpected spikes. Look for modules installed by Owner roles that generate continuous output without newlines.

Impact Analysis

An attacker with Owner privileges can install a malicious module to crash the SurrealDB server, making all namespaces and databases unavailable. The server may need a restart to recover, and data access is denied during the outage.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later. Disable the experimental Surrealism capability if not needed. Restrict Owner roles and only install trusted modules. Limit who can call module functions. Use an orchestrator to auto-restart the server on failure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109339. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart