---
id: CVE-2026-121423
title: 'SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization'
summary: >-
  SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that
  allows authenticated users to abort the surreald process by triggering stack
  overflow on deeply nested values. Attackers can repeatedly run UPDATE
  statements wrapp…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-674
vendor: surrealdb
product: surrealdb
affected:
  - surrealdb < 3.3.0
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T14:28:19.376Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121423'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg
    label: GitHub Security Advisory (GHSA-rpmq-gq3f-h6jg)
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-dos-via-unbounded-recursion-in-val-value-serialization
    label: >-
      VulnCheck Advisory: SurrealDB before 3.3.0 DoS via Unbounded Recursion in
      val::Value Serialization
tags:
  - cve.org
epss: 0.00339
epssPercentile: 0.27438
ingestedAt: '2026-11-05T19:30:42.968Z'
---

## Overview

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.

## Affected

- `surrealdb < 3.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.