PT-2026-61575 · Surrealdb · Surrealdb

Darkamaul · CVE-2026-63759 · Published 2026-07-20 · Updated 2026-07-20

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-63759

Affected Products

Surrealdb

References · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q8qp-67f9-wr3f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63759 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-denial-of-service-nested-type-annotations · Note