CVE-2026-109338: SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values

Q: Which deployments are exposed to this issue?

SurrealDB deployments running versions before 3.3.0 are exposed when query-capable users can execute embedded JavaScript with scripting enabled and can access non-ASCII HTTP header values.

Q: What access does an attacker need to crash the server?

An attacker needs query-capable access and scripting enabled. They must cause embedded JavaScript to read a non-ASCII header value through Headers.get(), entries(), values(), or getSetCookie(), or return such a value from a fetch() endpoint.

Q: Is this exploitable without authentication?

The provided information identifies the required attacker privilege as low and describes the attacker as a query-capable user. It does not establish that unauthenticated users can exploit the issue.

Q: What is the impact of successful exploitation?

Successful exploitation can abort the SurrealDB server process, resulting in a denial of service. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Published Oct 12, 2026

Updated

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

Affected Software

1 affected component

SurrealDB SurrealDB<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SurrealDB to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

SurrealDB deployments running versions before 3.3.0 are exposed when query-capable users can execute embedded JavaScript with scripting enabled and can access non-ASCII HTTP header values.

What access does an attacker need to crash the server?

An attacker needs query-capable access and scripting enabled. They must cause embedded JavaScript to read a non-ASCII header value through Headers.get(), entries(), values(), or getSetCookie(), or return such a value from a fetch() endpoint.

Is this exploitable without authentication?

The provided information identifies the required attacker privilege as low and describes the attacker as a query-capable user. It does not establish that unauthenticated users can exploit the issue.

What is the impact of successful exploitation?

Successful exploitation can abort the SurrealDB server process, resulting in a denial of service. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-109338: SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to crash the server?

Is this exploitable without authentication?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to crash the server?

Is this exploitable without authentication?

What is the impact of successful exploitation?