CVE-2026-63759: SurrealDB DOS Vulnerability

CVE-2026-63759 Overview

CVE-2026-63759 is a denial of service vulnerability in SurrealDB versions before 3.1.0. The database engine fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can submit queries containing deeply nested type annotations to exhaust server memory and crash the process.

The flaw is tracked as CWE-674: Uncontrolled Recursion and affects any deployment exposing the SurrealDB query interface to users with query privileges. The vulnerability requires only low-privileged authentication, making shared or multi-tenant SurrealDB instances particularly exposed.

Critical Impact
Any authenticated user can crash a SurrealDB server by submitting a single crafted query, disrupting availability for all tenants and applications relying on the database.

Affected Products

SurrealDB versions prior to 3.1.0
Self-hosted SurrealDB deployments exposing query endpoints to authenticated users
Multi-tenant environments where low-privileged accounts can submit queries

Discovery Timeline

2026-07-20 - CVE-2026-63759 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63759

Vulnerability Analysis

SurrealDB supports rich type annotations through its SurrealQL query language. The parser accepts nested type kinds such as arrays of arrays, sets of sets, and options wrapping other composite types. Parsing these constructs is implemented recursively.

Before version 3.1.0, the type/kind parser did not enforce a maximum recursion depth. An attacker submitting a query with sufficiently nested type annotations forces the parser to recurse until the process consumes all available stack or heap memory. The result is a crash of the SurrealDB process and loss of service for every connected client.

The issue is a resource exhaustion condition rather than a memory safety bug. No arbitrary code execution or data disclosure occurs. Impact is confined to availability, but the crash affects the entire database instance and all tenants sharing it.

Root Cause

The root cause is missing depth accounting in the recursive descent parser handling type annotations. Each nested array<...>, set<...>, or option<...> construct triggers another recursive call without bounding the stack depth or the memory allocated for the intermediate abstract syntax tree. CWE-674 covers this class of uncontrolled recursion defect.

Attack Vector

An attacker requires only low-privileged authenticated access to the SurrealDB query endpoint. The attacker submits a single query containing a deeply nested type annotation, for example wrapping array<...> inside itself many thousands of times. The parser recurses without bound, consuming memory until the operating system kills the process or the server aborts. See the GitHub Security Advisory GHSA-q8qp-67f9-wr3f and the VulnCheck Denial of Service Advisory for further technical context.

Detection Methods for CVE-2026-63759

Indicators of Compromise

Unexpected SurrealDB process termination or out-of-memory kills recorded in system logs (dmesg, journalctl).
Sudden spikes in resident memory consumption by the surreal process immediately preceding a crash.
Query logs containing unusually long strings of repeated type keywords such as array<, set<, or option<.

Detection Strategies

Inspect SurrealDB query logs for individual statements exceeding a reasonable length threshold or containing repeated nesting of type keywords.
Correlate database process restarts with the most recent authenticated query for each session to isolate the triggering client.
Alert on repeated crashes of the SurrealDB service within a short interval, which suggests intentional exploitation rather than a transient fault.

Monitoring Recommendations

Track memory utilization and process uptime for each SurrealDB node and alert on abrupt resets.
Enable authenticated query auditing and forward logs to a centralized platform for retention and search.
Monitor authentication events for low-privileged accounts that begin issuing atypically large or malformed queries.

How to Mitigate CVE-2026-63759

Immediate Actions Required

Upgrade all SurrealDB instances to version 3.1.0 or later without delay.
Audit existing SurrealDB user accounts and revoke query privileges from any identity that does not require them.
Restrict network exposure of the SurrealDB query endpoint to trusted application tiers using firewall rules or private networking.

Patch Information

SurrealDB 3.1.0 introduces recursion depth enforcement in the type/kind parser, rejecting queries whose type annotations exceed the safe limit. Details are published in the GitHub Security Advisory GHSA-q8qp-67f9-wr3f. Operators should validate the running version with surreal version after upgrading and restart all cluster nodes.

Workarounds

Place a reverse proxy or API gateway in front of SurrealDB that inspects incoming queries and rejects payloads above a fixed size threshold.
Configure operating system limits such as ulimit -v or systemd MemoryMax= to cap SurrealDB memory usage and enable rapid automated restart after a crash.
Segregate tenants across separate SurrealDB instances so that a crash triggered by one tenant does not affect others.

bash

# Example systemd override to bound memory and auto-restart SurrealDB
# /etc/systemd/system/surrealdb.service.d/override.conf
[Service]
MemoryMax=4G
Restart=always
RestartSec=5s