CVE-2026-63754 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write operations on a table for any user, including root, by registering a LIVE query that triggers evaluation errors until the query is killed or the session ends.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in SurrealDB versions prior to 3.1.0 and represents a significant denial of service weakness that undermines database integrity and operational continuity. The flaw specifically affects the LIVE query functionality where maliciously crafted queries containing WHERE clauses that evaluate to errors can trigger cascading failures across the database system. When such problematic queries are registered, they create a persistent state where all CREATE, UPDATE, and DELETE operations targeting the watched table become non-functional regardless of user permissions or administrative privileges.
The technical implementation of this vulnerability stems from inadequate error handling within SurrealDB's query processing engine, particularly in how it manages LIVE query subscriptions and their interaction with database write operations. When a LIVE query contains a WHERE clause that evaluates to an error condition, the system fails to properly isolate this error state from the broader transaction processing pipeline. This creates a scenario where the database engine becomes stuck in a failure mode where it cannot distinguish between legitimate write operations and those that should be blocked due to the malicious query state.
The operational impact of this vulnerability extends beyond simple service disruption as it enables authenticated users with minimal permissions to effectively lock out all write capabilities on targeted tables. This represents a privilege escalation vector where low-privilege users can create persistent denial of service conditions that affect the entire database system. The vulnerability particularly affects environments where multiple users or applications interact with the same tables, as the malicious query can prevent any user from performing write operations until the problematic LIVE query is explicitly terminated or the session expires.
This weakness aligns with CWE-400 which describes improper handling of exceptional conditions in software systems, and demonstrates how inadequate error propagation mechanisms can create systemic failures. From an ATT&CK perspective, this vulnerability maps to T1499.004 which covers testing for vulnerabilities in database systems, and represents a form of resource exhaustion attack where the system's ability to perform legitimate operations becomes impaired through malicious query construction.
Organizations should immediately upgrade to SurrealDB version 3.1.0 or later where this vulnerability has been addressed through improved error handling mechanisms and better isolation of LIVE query states from core database write operations. Additional mitigations include implementing strict monitoring for unusual LIVE query patterns, restricting the ability to register complex WHERE clauses in production environments, and establishing session timeout policies that automatically terminate long-running queries. Database administrators should also consider implementing automated alerting systems that detect when write operations begin failing across multiple tables simultaneously, as this pattern often indicates exploitation of similar vulnerabilities.