CVE-2026-109338CWE-248

CVE-2026-109338

Medium · published October 12, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2026-10-12T21:17Z
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-non-ascii-values · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 16:05Z
    SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values
    cvelistv5
  • 12 OCT 16:05Z
    SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values
    cvelistv5