CVE-2026-63737CWE-674

SurrealDB before 3.1.5 Denial of Service via deep operator chains

High · published July 20, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00487 · 41.0th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-07-20T12:04Z
EPSS history
Timeline
  • 20 JUL 12:04Z
    SurrealDB before 3.1.5 Denial of Service via deep operator chains
    cvelistv5