{"id":"CVE-2026-63747","aliases":["GHSA-wjjj-24cx-f28g"],"title":"SurrealDB has unauthenticated remote DoS via malformed RPC `use` call","summary":"SurrealDB has unauthenticated remote DoS via malformed RPC `use` call","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"surrealdb","product":"surrealdb","ecosystem":"rust","affected":["surrealdb < 3.1.0"],"patched":["surrealdb 3.1.0"],"published":"2026-07-01","updated":"2026-11-04","sourceUpdated":"2026-11-04T02:56:08.585978118Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wjjj-24cx-f28g","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wjjj-24cx-f28g"},{"url":"https://github.com/surrealdb/surrealdb/commit/1537ec4fbd789c61a5b43b648a854577dbe31a34"},{"url":"https://github.com/surrealdb/surrealdb"}],"tags":["osv","rust"],"epss":0.00515,"epssPercentile":0.44015,"ingestedAt":"2026-11-04T19:09:49.105Z","slug":"CVE-2026-63747","body":"## Overview\n\nA single unauthenticated WebSocket message to `/rpc` crashed the SurrealDB server. Sending `use { db: \"x\" }` without first selecting a namespace hit `.expect(\"namespace should be set\")` in the `use` handler; because `surrealdb-core` is built with `panic = 'abort'`, the panic terminated the process. `use` is callable before `signin`, and the per-method capability check passes by default for guest callers — so no credentials, token, or `--allow-guests` flag are required.\n\n### Impact\n\nAn unauthenticated remote attacker who could reach the `/rpc` endpoint could crash the SurrealDB server with a single WebSocket message. No credentials, token, session knowledge, or capability are required.\n\n### Patches\n\nA patch has been introduced that returns a typed `invalid_params` response when `db` is set on a session with no `ns`, replacing the panic.\n\n- Versions 3.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update should restrict network access to the `/rpc` endpoint to trusted clients, and run SurrealDB under a process supervisor that restarts on crash.\n\n## Affected packages\n\n- `surrealdb < 3.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `surrealdb 3.1.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}