CVE-2026-121423: high-severity vulnerability in surrealdb
SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
surrealdb · surrealdbRelated CVEs — surrealdb
In the same product, most dangerous first.
CVE-2024-58368HIGHSurrealDB before 1.1.0 Denial of Service via HTTP HeadersEPSS 0.7%CVE-2024-58362HIGHSurrealDB before 1.5.5 Query Injection via RPC APIEPSS 0.6%CVE-2024-58366CRITICALSurrealDB before 1.1.1 Format String via Scripting FunctionsEPSS 0.6%CVE-2025-71391HIGHSurrealDB before 2.2.2 Denial of Service via /sql endpointEPSS 0.6%CVE-2025-71397HIGHSurrealDB before 2.2.2 CPU Exhaustion via nested FOR loopsEPSS 0.6%CVE-2025-71396LOWSurrealDB before 2.2.2 Denial of Service via JavaScript ScriptingEPSS 0.6%