CVE-2026-63734CWE-20

CVE-2026-63734

Medium · published July 20, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other malformed header fields that trigger unchecked unwrap calls, causing a panic that aborts the entire server process and denies service to all databases.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-07-20T16:19Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 3.2.03.2.0
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jwr6-6444-28xv · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-malformed-surrealml-import · [email protected]
EPSS history
Timeline
  • 20 JUL 12:04Z
    SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import
    cvelistv5