CVE-2026-63759 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability affects SurrealDB versions prior to 3.1.0 and represents a critical denial of service condition stemming from inadequate recursion depth validation within the database's type/kind parser. The flaw manifests when authenticated users submit queries containing deeply nested type annotations that exceed the system's predetermined recursion limits, ultimately leading to memory exhaustion and process termination. The vulnerability operates at the parsing layer where SurrealDB processes type declarations and annotations, specifically targeting the recursive parsing mechanisms used to interpret complex type hierarchies.
The technical implementation of this vulnerability exploits the absence of proper depth limiting controls in the parser component responsible for handling type information within SurrealDB's query execution pipeline. When processing nested type annotations, the parser recursively traverses the type structure without enforcing maximum recursion depths, allowing attackers to craft malicious queries that create arbitrarily deep nesting levels. This recursive traversal consumes system resources linearly with each additional nesting level, eventually exhausting available memory and causing the database process to crash or become unresponsive.
From an operational perspective this vulnerability presents significant risk to database availability and system stability. Authenticated attackers with access to the database can leverage this weakness to perform denial of service attacks against SurrealDB instances, potentially disrupting legitimate operations and data access. The impact extends beyond simple service interruption as process crashes can lead to data consistency issues and require manual intervention for recovery. This vulnerability particularly affects environments where database administrators cannot easily monitor or control user query complexity, making it more dangerous in multi-tenant or shared database scenarios.
The vulnerability aligns with CWE-674 which specifically addresses the lack of recursion depth control in parsing operations, representing a classic example of uncontrolled recursion leading to resource exhaustion. From an ATT&CK framework perspective this maps to technique T1499.004 for network denial of service and potentially T1566.002 for phishing attacks that might be used to gain initial authenticated access before exploiting this vulnerability. The weakness demonstrates poor input validation practices in the parser implementation, where proper bounds checking should have been implemented to prevent excessive recursion during type annotation processing.
Mitigation strategies should prioritize upgrading to SurrealDB version 3.1.0 or later where recursion depth limits have been properly implemented and enforced. Additionally, administrators should implement query complexity monitoring and rate limiting mechanisms to detect and prevent suspicious query patterns before they can cause system instability. Database access controls should be strictly enforced to limit the ability of unauthorized users to execute potentially malicious queries, while regular security assessments should monitor for similar recursion-related issues in other parsing components. Implementing proper stack depth monitoring and resource allocation limits can provide additional protection layers against this class of vulnerabilities.