Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

SurrealDB before 3.1.0 crashes from deep JSON input

CVE-2026-63760 · published 3 months ago
Summary

SurrealDB versions before 3.1.0 are vulnerable to a denial of service attack. An attacker can send a specially crafted JSON message to the SurrealDB server, causing it to run out of memory and crash. To protect your SurrealDB server, update to version 3.1.0 or later.

What to do
  • Update surrealdb surrealdb to version 3.1.0 or later.
Affected software
VendorProductAffected versions
surrealdb surrealdb < 3.1.0
Original advisory text
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send...
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-674Uncontrolled Recursion
Timeline
Published20 Jul 2026
Updated4 Nov 2026
First seen20 Jul 2026
Sources
CVE-2026-63760 · NVD
CVE-2026-63760 · MITRE
Track software like this
Free during beta