CVE-2026-63760: SurrealDB DOS Vulnerability

CVE-2026-63760 Overview

CVE-2026-63760 is a denial of service vulnerability in SurrealDB versions before 3.1.0. The database engine fails to enforce the configured recursion depth limit inside the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint. The malformed input exhausts server memory and crashes the SurrealDB process, terminating service for all connected clients. The flaw is tracked under [CWE-674] Uncontrolled Recursion and carries a CVSS 4.0 score of 8.7.

Critical Impact
Remote unauthenticated attackers can crash SurrealDB instances by sending a single deeply nested JSON payload to the /rpc WebSocket endpoint, causing full service outage.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing the WebSocket /rpc endpoint to untrusted networks
Self-hosted and containerized SurrealDB instances across all supported platforms

Discovery Timeline

2026-07-20 - CVE-2026-63760 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63760

Vulnerability Analysis

SurrealDB exposes a WebSocket /rpc endpoint that accepts JSON-encoded remote procedure calls. The value parser and JSON parser both walk nested structures recursively when consuming input. SurrealDB documents a configurable recursion depth limit intended to bound this behavior, but the guard is not applied to sequences of nested braces {}, brackets [], or parentheses (). An attacker who submits a payload consisting of thousands of opening delimiters forces the parser into deep recursion. Each recursive call allocates stack and heap state, and the process consumes memory until it aborts. Because the /rpc endpoint accepts messages before authentication is validated, no credentials are required. A single WebSocket message is sufficient to terminate the database service and disconnect every active client session.

Root Cause

The root cause is missing enforcement of the recursion depth counter inside the parsing routines that handle nested delimiter tokens. The documented limit is checked in some parser paths but bypassed when the input contains only structural characters. This maps to [CWE-674] Uncontrolled Recursion. The parser continues descending until the process runs out of memory or stack space.

Attack Vector

Exploitation requires only network reachability to the SurrealDB WebSocket listener. The attacker opens a WebSocket connection to /rpc and sends a JSON RPC frame whose payload contains a long run of nested {, [, or ( characters. No authentication, user interaction, or prior knowledge of the schema is needed. The vulnerability affects availability only; confidentiality and integrity are not impacted. See the GitHub Security Advisory GHSA-q729-696q-g9pq and the VulnCheck Denial of Service Advisory for additional technical detail.

Detection Methods for CVE-2026-63760

Indicators of Compromise

SurrealDB process crashes or restarts correlated with inbound WebSocket traffic to /rpc.
Sudden memory pressure or out-of-memory kills on the host running SurrealDB.
WebSocket frames to /rpc containing abnormally long runs of {, [, or ( characters with no matching closing tokens.

Detection Strategies

Inspect WebSocket payloads destined for /rpc and flag messages whose nesting depth exceeds a reasonable application threshold.
Alert on SurrealDB service restarts and unexpected termination events in systemd, container orchestrators, or process supervisors.
Correlate spikes in resident set size (RSS) for the surreal process with concurrent /rpc connections from a single source.

Monitoring Recommendations

Ship SurrealDB stdout, stderr, and crash logs to a central log platform and alert on abnormal exit codes.
Track WebSocket connection counts and message sizes per source IP at the reverse proxy or load balancer.
Monitor host-level memory metrics and kernel OOM killer events for the SurrealDB process.

How to Mitigate CVE-2026-63760

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later on every node in the cluster.
Restrict network access to the /rpc WebSocket endpoint using firewalls, security groups, or a reverse proxy that requires authentication.
Audit exposure of SurrealDB instances to the public internet and remove any unintended listeners.

Patch Information

SurrealDB 3.1.0 enforces the recursion depth limit inside the value and JSON parser for nested braces, brackets, and parentheses. Patch details are published in the GitHub Security Advisory GHSA-q729-696q-g9pq. Operators running earlier 1.x, 2.x, or 3.0.x releases must upgrade; there is no backported fix for prior branches referenced in the advisory.

Workarounds

Place SurrealDB behind a reverse proxy that inspects and rejects WebSocket messages exceeding a maximum size or nesting depth.
Terminate WebSocket connections from clients that transmit malformed or unbalanced JSON structures.
Apply per-source rate limits and connection quotas to the /rpc endpoint to reduce the impact of repeated crash attempts.

bash

# Example nginx limits in front of SurrealDB /rpc
http {
    client_max_body_size 64k;
    limit_req_zone $binary_remote_addr zone=rpc:10m rate=5r/s;

    server {
        listen 443 ssl;
        location /rpc {
            limit_req zone=rpc burst=10 nodelay;
            proxy_pass http://surrealdb_upstream;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_read_timeout 30s;
        }
    }
}