CVE-2026-63760 | SurrealDB before 3.1.0 fails to enforce the configured recur… | CVSS 7.5 HIGH

Description

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

Metadata

CVE ID: CVE-2026-63760
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-18 12:30 UTC
Published: 2026-07-20 12:04 UTC
Last updated: 2026-07-20 12:51 UTC
Primary CWE: CWE-674
Uncontrolled Recursion
Vendor / Product: surrealdb / surrealdb
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
surrealdb	surrealdb	—	0 < 3.1.0, 3.1.0

Weakness (CWE)

CWE	Source	Description
CWE-674	cna	Uncontrolled Recursion

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

GitHub Security Advisory (GHSA-q729-696q-g9pq) https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq
VulnCheck Advisory: SurrealDB before 3.1.0 Denial of Service via JSON Parser https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser