CVE-2026-109339: falha de média gravidade em surrealdb
SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — surrealdb
No mesmo produto, das mais perigosas para as menos.
CVE-2024-58368HIGHSurrealDB before 1.1.0 Denial of Service via HTTP HeadersEPSS 0.7%CVE-2024-58362HIGHSurrealDB before 1.5.5 Query Injection via RPC APIEPSS 0.6%CVE-2024-58366CRITICALSurrealDB before 1.1.1 Format String via Scripting FunctionsEPSS 0.6%CVE-2025-71391HIGHSurrealDB before 2.2.2 Denial of Service via /sql endpointEPSS 0.6%CVE-2025-71397HIGHSurrealDB before 2.2.2 CPU Exhaustion via nested FOR loopsEPSS 0.6%CVE-2025-71396LOWSurrealDB before 2.2.2 Denial of Service via JavaScript ScriptingEPSS 0.6%