CVE-2026-63737: Surrealdb SurrealDB DOS Vulnerability

CVE-2026-63737 Overview

CVE-2026-63737 is a denial of service vulnerability in SurrealDB versions before 3.1.5. Authenticated users can crash the database server by submitting queries containing tens of thousands of chained operators. The malformed queries construct unbounded expression trees that trigger a stack overflow during query processing, aborting the entire server process. The flaw is categorized under [CWE-674] (Uncontrolled Recursion) and affects the availability of the database service. Any client with valid credentials can trigger the condition over the network, making it a practical threat in multi-tenant deployments where low-privileged users share a SurrealDB instance.

Critical Impact
A single authenticated query containing deeply nested operators aborts the SurrealDB process, denying service to all connected clients until the server is restarted.

Affected Products

SurrealDB versions prior to 3.1.5
Deployments exposing the SurrealDB query interface to authenticated users
Multi-tenant SurrealDB instances where low-privileged accounts can submit arbitrary queries

Discovery Timeline

2026-07-20 - CVE-2026-63737 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63737

Vulnerability Analysis

SurrealDB parses SurrealQL queries into an expression tree before execution. When a query contains a long chain of operators, the parser and evaluator recurse through each node in the resulting tree. Version 3.1.5 and earlier apply no upper bound on operator chain depth, so an attacker can submit an input with tens of thousands of chained operators. The recursion consumes the thread stack until the operating system aborts the process. Because the crash terminates the entire SurrealDB process rather than a single request handler, all in-flight and subsequent queries fail until an operator restarts the service. The vulnerability requires authentication but no user interaction, and the attacker gains no confidentiality or integrity impact.

Root Cause

The root cause is uncontrolled recursion during expression tree construction and evaluation. SurrealDB does not enforce a maximum depth for chained operators, allowing an authenticated caller to control the depth of the recursive descent. Once the recursion depth exceeds the available stack, the runtime raises a stack overflow that Rust cannot recover from at process scope.

Attack Vector

An authenticated user submits a single SurrealQL query containing an extremely long sequence of chained operators over the standard network interface. No elevated privileges, no user interaction, and no adjacency to the target are required. The exploit primitive is a plain query payload delivered through the same channel legitimate clients use. Refer to the VulnCheck Advisory on SurrealDB and the GitHub Security Advisory GHSA-jv2j-mqmw-xvv5 for the vendor description of the attack path.

No public exploit or proof-of-concept code is currently available. See the vendor advisory for technical details.

Detection Methods for CVE-2026-63737

Indicators of Compromise

Unexpected SurrealDB process terminations with stack overflow signatures in system logs or dmesg output.
Inbound queries whose payload size or operator count is orders of magnitude larger than typical application traffic.
Repeated client reconnection attempts following abrupt server termination without a clean shutdown log entry.

Detection Strategies

Monitor SurrealDB process lifecycle and alert on abnormal exits, especially those preceded by a single large query.
Inspect query logs for unusually long operator sequences or payload sizes that exceed application baselines.
Correlate authentication events with subsequent server crashes to identify accounts that trigger the condition.

Monitoring Recommendations

Enable verbose query logging on SurrealDB and forward logs to a centralized platform for retention and analysis.
Track service uptime and restart counters for the SurrealDB process to detect crash-loop patterns.
Baseline typical query size and depth per application and alert on statistical outliers.

How to Mitigate CVE-2026-63737

Immediate Actions Required

Upgrade SurrealDB to version 3.1.5 or later on all production and non-production instances.
Audit database accounts and revoke credentials that do not require direct query access.
Place SurrealDB behind a proxy or gateway that can enforce request size limits until patching is complete.

Patch Information

SurrealDB addressed the vulnerability in version 3.1.5. The fix is described in the GitHub Security Advisory GHSA-jv2j-mqmw-xvv5. Operators should validate the running version after upgrade using the SurrealDB CLI and confirm all client SDKs remain compatible with the patched release.

Workarounds

Restrict authenticated access to SurrealDB to trusted application service accounts only.
Enforce a maximum request body size at the network layer to reject oversized SurrealQL payloads.
Deploy process supervisors that automatically restart SurrealDB after a crash to reduce downtime while patching is scheduled.

bash

# Example: cap request body size at an nginx reverse proxy in front of SurrealDB
server {
    listen 443 ssl;
    server_name surrealdb.example.com;

    client_max_body_size 64k;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_read_timeout 30s;
    }
}