PT-2026-61553 · Surrealdb · Surrealdb

CVE-2026-63737 · Publicado 2026-07-20 · Atualizado 2026-07-20

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.

Correção

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CVE-2026-63737

Produtos afetados

Surrealdb

Referências · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jv2j-mqmw-xvv5 · Aviso do Fabricante
• https://vulncheck.com/advisories/surrealdb-before-denial-of-service-via-deep-operator-chains · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63737 · Nota de Segurança