CVE-2026-63750 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability affects SurrealDB versions prior to 3.1.0 and represents a critical memory exhaustion issue that undermines the database's availability and resource management capabilities. The flaw specifically targets anonymous websocket connections to the /sql endpoint where the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE configuration limit is not properly enforced, creating a pathway for attackers to bypass intended security controls through unbounded message buffering.
The technical implementation of this vulnerability stems from an inconsistent application of websocket message size limits within the SurrealDB codebase. When anonymous users establish connections to the /sql websocket endpoint, the system fails to validate incoming frame sizes against the configured maximum message size parameter. This oversight allows attackers to stream multiple WebSocket frames that collectively exceed the intended limit, with each connection maintaining its own read buffer that grows without bounds. The vulnerability operates at the protocol level where websocket frames are processed individually but not aggregated against the configured limits across multiple connections.
The operational impact of this vulnerability manifests as significant memory consumption and potential service degradation or complete unavailability of the /sql endpoint. Attackers can leverage concurrent connections to accumulate memory usage beyond normal operational parameters, effectively creating a resource exhaustion attack that impacts other legitimate users. The cumulative effect of multiple simultaneous connections streaming oversized frames can rapidly consume available system memory, leading to process crashes, performance degradation, or denial of service conditions that affect database availability and user access.
This vulnerability aligns with CWE-400 which addresses "Uncontrolled Resource Consumption" and represents a specific implementation weakness in resource management controls. From an ATT&CK perspective it maps to T1499.004 "Endpoint Denial of Service" and potentially T1566.002 "Phishing via Social Media" if attackers leverage this vulnerability as part of broader attack chains. The flaw demonstrates poor input validation and resource boundary enforcement, where the system fails to properly isolate and limit resources consumed by individual connections while maintaining the expected security boundaries.
Mitigation strategies should focus on implementing proper websocket frame size validation for all connection types, including anonymous ones, and ensuring that configuration parameters like SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE are consistently enforced across all websocket endpoints. System administrators should immediately upgrade to SurrealDB version 3.1.0 or later where this vulnerability has been patched. Additionally, implementing connection rate limiting, monitoring for unusual memory consumption patterns, and establishing proper websocket frame size validation at the protocol level will help prevent similar issues in other components of the system architecture.