CVE-2026-63760High· 7.5▾ TwilightSurrealDB has Denial of Service in JSON parser due to nested objects
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when parsing nested {, [, or ( tokens. The expression parser already enforced the limit for these tokens; the value/JSON parser omitted it. An unauthenticated attacker could send a deeply nested JSON payload to the WebSocket /rpc endpoint and exhaust server memory, crashing the process.
This is an incomplete fix for GHSA-6r8p-hpg7-825g, which addressed the same class of bug in the expression parser but did not cover the value/JSON parser code path.
An unauthenticated remote attacker can crash a SurrealDB server with a single WebSocket message. No credentials or query execution privileges are required.
A patch enforces the configured recursion depth limit in parse_value and parse_json, bringing them in line with the rest of the parser.
Restrict network access to the WebSocket /rpc endpoint to trusted clients.
surrealdb < 3.1.0Upgrade to a patched release:
surrealdb 3.1.0Connected by shared product, vendor, weakness, or advisory.
GHSA-q729-696q-g9pqHigh· 7.5SurrealDB has Denial of Service in JSON parser due to nested objects
CVE-2026-63746Medium· 6.5SurrealDB: Graph traversal bypasses table SELECT permissions
CVE-2026-63738Medium· 4.3SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
CVE-2026-63758Medium· 5.4SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
CVE-2026-63761Medium· 4.3SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
CVE-2026-63751Medium· 4.3SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`