CVE-2026-109339 in SurrealDB
Summary
by MITRE • 10/12/2026
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in SurrealDB versions prior to 3.3.0 represents a critical resource exhaustion flaw within its modular execution environment, specifically affecting how stdout and stderr streams are managed for Surrealism modules. This issue stems from an unbounded buffering mechanism where output generated by these modules is accumulated in host memory without any size constraints or periodic flushing mechanisms that would respect the configured module memory limits. Consequently, even if a strict memory ceiling is defined for individual modules to prevent runaway processes, this safeguard is effectively bypassed because the logging subsystem operates independently of those resource controls. This architectural oversight allows data generated by external scripts or plugins to consume arbitrary amounts of system RAM, leading directly to severe performance degradation and eventual service termination.
From an operational perspective, the impact of this vulnerability is profound for any deployment relying on Surrealism modules that produce significant output without newline characters. An attacker with Owner-level privileges can install a malicious module designed specifically to write continuous streams of data to standard out or error channels while omitting line breaks. This technique forces the server to hold every single character in memory until it either crashes due to an Out-Of-Memory condition or is manually restarted by administrators. The resulting denial of service affects all namespaces and databases hosted on that instance, not just the specific database associated with the malicious module, thereby compromising the availability integrity for the entire system infrastructure.
This flaw aligns closely with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-789, Memory Exhaustion. In terms of adversarial tactics, this vulnerability facilitates Denial of Service attacks categorized under MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via resource exhaustion. The attack vector requires initial access with Owner privileges to install the module, highlighting that while the technical flaw is severe, it relies on a level of trust or compromise within the application's permission structure. This underscores the importance of strict privilege separation and careful auditing of installed modules in production environments where SurrealDB is utilized for data management and logic execution.
Mitigation strategies must prioritize immediate upgrading to version 3.3.0 or later, which addresses this buffering issue by implementing proper limits on stream output sizes. In the interim, administrators should enforce strict monitoring of memory usage associated with module executions and consider restricting the ability to install new modules unless absolutely necessary. Implementing network-level controls such as Web Application Firewalls can help detect anomalous patterns in API calls related to module installation or execution. Furthermore, adopting a principle of least privilege for database users ensures that only trusted entities have the authority to introduce external code into the Surrealism environment, thereby reducing the attack surface available to potential adversaries seeking to exploit this resource exhaustion vector.