Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck
CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parser
High 7.5
In plain English
A high-severity security flaw in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
Affected products (as reported)
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-q729-696q-g9pq) vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.1.0 Denial of Service via JSON Parser third-party-advisory