CVE-2026-63759

7.1 highEPSS 0.4%

High (7.1) in surrealdb surrealdb. EPSS 0.4% chance of exploitation in the next 30 days.

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-674
Published: 2026-07-20
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

Affected

surrealdb:surrealdb

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q8qp-67f9-wr3f
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-nested-type-annotations

Check your stack JSON