Read the docs
TI-2026-84305 Aliases CVE-2026-121423GHSA-934p-hvjv-46qj

Unbounded recursion in SurrealDB allows denial of service

Priority LOW 31CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

SurrealDB before 3.3.0 contains unbounded recursion in value serialization, a flaw classified as CWE-674. An authenticated user with low privileges can nest stored values deeply enough to overflow the stack and abort the surreald process. Repeated attacks cause a persistent denial of service for all tenants.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.

Why it matters now

EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed surrealdb (surrealdb): 3.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
surrealdbsurrealdbbefore 3.3.03.3.0Patch availableCNA
  • surrealdb Vendorsurrealdb Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*——surrealdb
  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* Versions — — ·surrealdb

Remediation

Upgrade SurrealDB to version 3.3.0, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA surrealdb (surrealdb) Fixed in 3.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    surrealdb 3.3.0

    7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-84300 SurrealDB index planner lets users infer restricted fieldsPriority MEDIUM 57
    • TI-2026-84304 Server-side request forgery in SurrealDB via JWKS URL default portsPriority MEDIUM 56
    • TI-2026-84301 MCP session hijack in SurrealDB via shared BoundSubject fingerprintPriority LOW 37
    Show all 7 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121423
  2. 2026-11-03 Alias added: GHSA-934p-hvjv-46qj
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2026-84300 SurrealDB index planner lets users infer restricted fields CVSS 4.0MEDIUM 5.3
  • TI-2026-84304 Server-side request forgery in SurrealDB via JWKS URL default ports CVSS 4.0MEDIUM 5.1
  • TI-2026-45344 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions CVSS 4.0HIGH 8.7
  • TI-2024-38452 SurrealDB before 1.1.0 Denial of Service via HTTP Headers CVSS 4.0HIGH 8.7
  • TI-2026-45347 SurrealDB before 3.1.0 Denial of Service via JSON Parser CVSS 4.0HIGH 8.7
  • TI-2026-45334 SurrealDB before 3.1.0 Denial of Service via malformed RPC use CVSS 4.0HIGH 8.7
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences