Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109339SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering

Medium 4.9

In plain English

A medium-severity resource allocation without limits in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.4%top 68.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	3.1.0 – before 3.3.0
surrealdb	surrealism-runtime	0.3.0 – before 0.6.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-jj89-wvrw-c4gp) vendor-advisory
VulnCheck Advisory: SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering third-party-advisory