PT-2026-61576 · Surrealdb · Surrealdb

Darkamaul · CVE-2026-63760 · Publicado 2026-07-20 · Atualizado 2026-07-20

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

Correção

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CVE-2026-63760

Produtos afetados

Surrealdb

Referências · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-63760 · Nota de Segurança
• https://vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser · Nota