Unrated severityNVD Advisory· Published Jul 20, 2026· Updated Jul 28, 2026
SurrealDB before 3.1.0 Denial of Service nested type annotations
CVE-2026-63759
Description
SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-q8qp-67f9-wr3fmitrevendor-advisory
- www.vulncheck.com/advisories/surrealdb-before-denial-of-service-nested-type-annotationsmitrethird-party-advisory
News mentions
0No linked articles in our index yet.