surrealdb vulnerabilities
CVEs whose affected-version data names the surrealdb package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
87 CVEsRSS
CVE-2025-71397Medium· 6.5SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nest…
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nest…
CVE-2025-71396Medium· 6.5⚖ disputedSurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or -…
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or -…
CVE-2025-71395Medium· 6.5SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns
SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to …
CVE-2025-71394Medium· 4.3⚖ disputedSurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privil…
CVE-2025-71393Medium· 6.5SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries
SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native…
CVE-2025-71392High· 8.0SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields wit…
CVE-2025-71391Medium· 6.5SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database
SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, caus…
CVE-2025-71390High· 8.8SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>)…
CVE-2024-58366High· 8.5SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled
SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitr…
CVE-2024-58363Medium· 6.3SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database i…
CVE-2026-63741Medium· 6.5SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
CVE-2026-63759Medium· 6.5SurrealDB vulnerable to Denial of Service due to nested types annotations
SurrealDB vulnerable to Denial of Service due to nested types annotations
CVE-2026-63747High· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
CVE-2026-63749Medium· 4.3SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
CVE-2026-63742Medium· 4.3SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
CVE-2026-63757High· 8.8SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
CVE-2026-63750Medium· 5.3SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
CVE-2026-63756High· 8.1SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
CVE-2026-63754Medium· 6.5SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
CVE-2026-63753Medium· 4.3SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
CVE-2026-63752Medium· 4.3SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
CVE-2026-63760High· 7.5SurrealDB has Denial of Service in JSON parser due to nested objects
SurrealDB has Denial of Service in JSON parser due to nested objects
CVE-2026-63758Medium· 5.4SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
CVE-2026-63743Medium· 6.4SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
CVE-2026-63748Medium· 4.3SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
GHSA-6g9v-7gq3-p2c6Medium· 4.3SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
GHSA-fpxg-5xmv-922mMedium· 4.3SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
GHSA-f82j-v89j-mf86Medium· 4.3SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
GHSA-6wqw-vhfr-9999Medium· 4.3SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
GHSA-97vg-427p-8hx5Medium· 6.4SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect