CVE-2026-121423 in SurrealDB
Summary
by MITRE • 11/03/2026
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The identified vulnerability represents a critical flaw within SurrealDB versions prior to 3.3.0, specifically categorized as an unbounded recursion issue that leads to stack overflow conditions. This security defect is primarily associated with CWE-674, which describes the improper control of recursive operations where depth limits are not enforced. The core technical failure occurs when the database engine attempts to process deeply nested data structures without adequate safeguards against infinite or excessively deep recursion. In a typical operational scenario involving SurrealDB's document-oriented architecture, users can store complex hierarchical data such as arrays containing other arrays. When an authenticated user constructs UPDATE statements that recursively wrap a stored array within itself, they create a data structure of exponential depth relative to the number of operations performed.
Upon execution of SELECT or EXPORT queries against these malformed records, the database engine attempts to traverse and serialize the nested structures for output. Because the recursion limit is not properly bounded by default in affected versions, the processing logic enters an infinite loop that rapidly consumes available stack memory on the server process. This resource exhaustion results in a crash of the surreald binary process. The impact extends beyond simple application instability; it constitutes a persistent denial of service affecting all tenants sharing the same database instance. Since SurrealDB often operates as a multi-tenant system, the failure of the main process disrupts availability for every user connected to that specific deployment, rather than isolating the fault to a single session or tenant context.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer attacks. The attack vector requires authentication, which classifies it as CWE-287, Improper Authentication, in the sense that valid credentials are leveraged to trigger system-level failures rather than unauthorized access. However, the primary severity lies in its availability impact. An attacker with low privileges can escalate their impact from a simple session disruption to a complete service outage by exploiting this recursion flaw repeatedly or persistently until the process terminates and requires manual restart.
Mitigation strategies must focus on immediate version upgrades and architectural hardening. The most effective remediation is upgrading SurrealDB to version 3.3.0 or later, where developers have implemented proper depth limits for recursive data processing operations. For environments unable to upgrade immediately due to compatibility constraints, operational mitigations include implementing strict input validation at the application layer to prevent the storage of excessively nested structures before they reach the database engine. Additionally, deploying a reverse proxy with rate limiting can help mitigate repeated exploitation attempts by throttling requests that exhibit patterns consistent with recursive data construction. Monitoring system logs for frequent process restarts or stack overflow errors should also be established as part of routine security operations to detect potential abuse early.