PT-2026-61553 · Surrealdb · Surrealdb

CVE-2026-63737 · Published 2026-07-20 · Updated 2026-07-20

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-63737

Affected Products

Surrealdb

References · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jv2j-mqmw-xvv5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63737 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-denial-of-service-via-deep-operator-chains · Note