CVE-2026-63734 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other malformed header fields that trigger unchecked unwrap calls, causing a panic that aborts the entire server process and denies service to all databases.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within SurrealDB versions prior to 3.2.0 and represents a critical denial of service flaw affecting the SurrealML header parser functionality. The issue specifically targets authenticated users possessing Owner role privileges who can exploit the /ml/import endpoint to upload maliciously crafted .surml files. The technical implementation contains unchecked unwrap operations that fail to properly validate input dimensions and other header fields during the parsing process. When attackers supply non-numeric input-dimensions or other malformed header parameters, these inputs trigger panic conditions within the server runtime environment.
The operational impact of this vulnerability extends beyond simple service disruption as it fundamentally compromises server stability and availability. The unchecked unwrap calls in the SurrealML parser create a scenario where any malformed input causes an immediate panic state that results in complete server process abortion. This panic condition affects all database operations and services hosted by the SurrealDB instance, creating widespread denial of service across the entire system rather than isolated functional failures. The vulnerability essentially provides authenticated attackers with a reliable method to terminate server processes at will, making it particularly dangerous in production environments where continuous availability is critical.
From a cybersecurity perspective, this vulnerability aligns with CWE-476 which addresses null pointer dereference conditions and CWE-691 which covers insufficient input validation leading to unchecked exceptions. The attack vector follows patterns consistent with ATT&CK technique T1499.004 related to network denial of service attacks through resource exhaustion or process termination. The fact that this requires only Owner role authentication makes it particularly concerning as it allows privilege escalation scenarios where attackers can leverage existing elevated permissions to cause system-wide outages. Organizations should immediately implement patch management protocols to upgrade to SurrealDB 3.2.0 or later versions where these parsing validation checks have been implemented.
The root cause stems from inadequate input validation mechanisms within the SurrealML header parser component, specifically failing to sanitize numeric inputs for dimension parameters and other structured fields before processing. This lack of defensive programming practices creates an attack surface where malformed data can propagate through the system without proper error handling or graceful degradation mechanisms. The vulnerability demonstrates poor adherence to secure coding principles that mandate input validation, exception handling, and robust error recovery procedures. Security teams should consider implementing additional monitoring for suspicious upload activities and establish automated alerting for unusual server process termination events.
Mitigation strategies include immediate deployment of SurrealDB 3.2.0 patches which contain proper input validation and error handling for the affected parser component. Network-level controls can be implemented to restrict access to the /ml/import endpoint to only necessary administrative users, reducing the attack surface available to potential exploiters. Additionally, implementing comprehensive logging and monitoring solutions that track file upload activities and server process states will aid in early detection of exploitation attempts. Organizations should also conduct regular security assessments of their SurrealDB installations to identify similar input validation vulnerabilities in other components that might be susceptible to similar attacks through different code paths.