CVE-2026-63760 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability in SurrealDB versions prior to 3.1.0 represents a critical denial of service weakness that stems from insufficient input validation during JSON parsing operations. The flaw occurs when the database processes nested structural elements such as braces, brackets, and parentheses within JSON payloads through its WebSocket rpc endpoint. The system fails to properly enforce the configured recursion depth limits that should prevent excessive nesting levels from consuming system resources. This represents a classic case of inadequate depth limiting in recursive parsing algorithms, which falls under CWE-674 - Uncontrolled Recursion and CWE-400 - Uncontrolled Resource Consumption.
The operational impact of this vulnerability is severe as it allows unauthenticated attackers to exploit the weakness without requiring any credentials or prior access to the system. By crafting maliciously nested JSON payloads and sending them to the /rpc WebSocket endpoint, attackers can trigger a memory exhaustion condition that ultimately leads to process crashes and service disruption. This attack vector directly maps to ATT&CK technique T1499.004 - Network Denial of Service, where adversaries leverage application-level vulnerabilities to consume system resources and render services unavailable.
The technical implementation flaw lies in the parser's failure to maintain proper stack depth tracking during recursive JSON parsing operations. When nested structures exceed the configured limits, the system should terminate processing or enforce strict depth boundaries, but instead continues to allocate memory for each nesting level until system resources are exhausted. This creates a resource consumption vulnerability that affects both the database's memory management and overall system stability. The vulnerability specifically targets the value parser and JSON parser components, which are fundamental to SurrealDB's data handling capabilities.
Mitigation strategies should include immediate upgrade to SurrealDB 3.1.0 or later versions where proper recursion depth enforcement has been implemented. Administrators should also consider implementing rate limiting and input size restrictions on WebSocket endpoints to provide additional defense in depth. Network-level controls such as firewall rules that limit access to the rpc endpoint can help reduce exposure, while monitoring systems should be configured to detect unusual patterns of nested JSON data that might indicate exploitation attempts. The fix implemented in version 3.1.0 likely includes proper stack depth tracking and enforcement mechanisms that prevent recursive parsing from exceeding safe limits, thereby preventing memory exhaustion attacks and maintaining system availability.