PT-2026-61576 · Surrealdb · Surrealdb

Darkamaul · CVE-2026-63760 · Published 2026-07-20 · Updated 2026-07-20

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-63760

Affected Products

Surrealdb

References · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63760 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser · Note