Medium severity6.4NVD Advisory· Published Jul 20, 2026· Updated Jul 22, 2026
CVE-2026-63743
CVE-2026-63743
Description
SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
surrealdbcrates.io | < 3.1.0 | 3.1.0 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-97vg-427p-8hx5ghsaADVISORY
- github.com/surrealdb/surrealdb/security/advisories/GHSA-97vg-427p-8hx5nvdVendor AdvisoryMitigationWEB
- nvd.nist.gov/vuln/detail/CVE-2026-63743ghsaADVISORY
- www.vulncheck.com/advisories/surrealdb-before-port-specific-deny-rule-bypass-via-http-redirectnvdThird Party AdvisoryWEB
- github.com/surrealdb/surrealdb/commit/https://github.com/surrealdb/surrealdb/commit/ceb1ca3a1ghsaWEB
News mentions
0No linked articles in our index yet.