CVE-2026-63760: SurrealDB before 3.1.0 Denial of Service via JSON Parser

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-07-22
Weakness: CWE-674

Description

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

Affected products

surrealdb: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: surrealdb 3.1.0. Check the vendor advisory for mitigations.

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser

Get alerted when CVE-2026-63760 or the next vulnerability affects your stack