GHSA-wjjj-24cx-f28gHigh· 7.5▾ TwilightSurrealDB has unauthenticated remote DoS via malformed RPC `use` call
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A single unauthenticated WebSocket message to /rpc crashed the SurrealDB server. Sending use { db: "x" } without first selecting a namespace hit .expect("namespace should be set") in the use handler; because surrealdb-core is built with panic = 'abort', the panic terminated the process. use is callable before signin, and the per-method capability check passes by default for guest callers — so no credentials, token, or --allow-guests flag are required.
An unauthenticated remote attacker who could reach the /rpc endpoint could crash the SurrealDB server with a single WebSocket message. No credentials, token, session knowledge, or capability are required.
A patch has been introduced that returns a typed invalid_params response when db is set on a session with no ns, replacing the panic.
Affected users who are unable to update should restrict network access to the /rpc endpoint to trusted clients, and run SurrealDB under a process supervisor that restarts on crash.
surrealdb < 3.1.0Upgrade to a patched release:
surrealdb 3.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63747High· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
GHSA-4v76-cw68-4vc9Medium· 6.5SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
CVE-2026-109338Medium· 6.5SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript
CVE-2025-71391Medium· 6.5SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database
CVE-2026-63741Medium· 6.5SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
CVE-2026-63759Medium· 6.5SurrealDB vulnerable to Denial of Service due to nested types annotations