CVE-2026-63750: SurrealDB WebSocket DoS Vulnerability

CVE-2026-63750 Overview

CVE-2026-63750 is a resource exhaustion vulnerability in SurrealDB versions prior to 3.1.0. The database engine fails to enforce the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit on anonymous /sql WebSocket connections. Unauthenticated attackers can stream WebSocket frames that exceed the configured message size ceiling, buffering unbounded data in the per-connection read buffer. Concurrent connections amplify memory consumption and degrade the availability of the /sql endpoint. The weakness is categorized under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Remote unauthenticated attackers can exhaust server memory by streaming oversized WebSocket frames across multiple concurrent /sql connections, degrading database availability.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing the /sql WebSocket endpoint to untrusted networks
Configurations relying on SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE for anonymous traffic limits

Discovery Timeline

2026-07-20 - CVE-2026-63750 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63750

Vulnerability Analysis

SurrealDB exposes an interactive /sql endpoint over WebSocket for streaming query execution. The server accepts a configurable maximum message size through the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE environment variable. This limit is intended to bound per-frame and per-message memory allocation on incoming traffic.

On anonymous connections to /sql, the enforcement path is skipped. The read loop continues to append incoming frame data to the per-connection read buffer without checking cumulative size against the configured ceiling. Attackers can hold connections open and stream fragmented frames indefinitely.

Because the buffer grows unbounded per connection, and WebSocket sessions can be opened concurrently without authentication, memory pressure scales linearly with attacker resources. The result is degraded query throughput, out-of-memory conditions, and denial of service against the /sql service. The VulnCheck Security Advisory documents the amplification behavior.

Root Cause

The root cause is a missing size check on the anonymous WebSocket read path. The message size guard applied to authenticated sessions is not applied to unauthenticated /sql handlers, leaving the read buffer without an enforced upper bound.

Attack Vector

Exploitation requires only network reachability to the SurrealDB /sql WebSocket endpoint. No credentials, user interaction, or elevated privileges are needed. Attackers open one or more anonymous WebSocket sessions and transmit continuation frames whose aggregate size exceeds the intended limit. See the SurrealDB GitHub Security Advisory GHSA-65rj-r9fh-jp2v for vendor-confirmed details.

No public proof-of-concept, exploit database entry, or CISA KEV listing exists for this issue at publication time. EPSS data reports a probability of 0.278% at percentile 20.007 as of 2026-07-23.

Detection Methods for CVE-2026-63750

Indicators of Compromise

Sustained high memory utilization on SurrealDB server processes without a matching increase in legitimate query volume
Multiple concurrent WebSocket sessions to /sql originating from a single source or small set of sources
WebSocket connections that remain open for extended periods while continuously transmitting continuation frames
Reverse proxy or load balancer logs showing large aggregate inbound bytes on /sql upgrade requests

Detection Strategies

Instrument SurrealDB with process-level memory metrics and alert on rapid growth in resident set size (RSS)
Parse HTTP access logs at the proxy layer for Upgrade: websocket requests targeting /sql and baseline expected concurrency
Correlate anonymous /sql sessions with per-source connection counts to identify amplification patterns

Monitoring Recommendations

Track WebSocket frame counts and cumulative bytes per session at the reverse proxy or WAF
Monitor /sql endpoint availability and query latency to detect early degradation
Alert when the number of unauthenticated /sql sessions exceeds a defined threshold per source IP

How to Mitigate CVE-2026-63750

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later where the message size limit is applied on anonymous /sql connections
Restrict network access to the /sql WebSocket endpoint using firewall rules or private network segmentation
Require authentication for /sql access wherever the deployment model permits
Place SurrealDB behind a reverse proxy that enforces WebSocket message size and connection limits

Patch Information

The SurrealDB maintainers addressed CVE-2026-63750 in release 3.1.0. Refer to the SurrealDB GitHub Security Advisory GHSA-65rj-r9fh-jp2v for the fix details and version guidance.

Workarounds

Terminate WebSocket connections at an upstream proxy such as NGINX or Envoy and configure proxy_max_temp_file_size, client_max_body_size, and frame size limits
Apply per-IP connection rate limiting on the /sql route to bound concurrency
Disable anonymous access to /sql by enforcing authentication middleware at the ingress layer
Set operating system memory cgroup limits on the SurrealDB process to contain the blast radius

bash

# Configuration example
# Upgrade to a patched release
surreal version
# Expect: 3.1.0 or later

# NGINX ingress mitigation: cap WebSocket message size and concurrency
# nginx.conf snippet
# location /sql {
#     proxy_pass http://surrealdb_upstream;
#     proxy_http_version 1.1;
#     proxy_set_header Upgrade $http_upgrade;
#     proxy_set_header Connection "upgrade";
#     client_max_body_size 1m;
#     limit_conn per_ip 5;
#     limit_req zone=sql_zone burst=10 nodelay;
# }