CVE-2026-109339: SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering

Q: Who can exploit this issue?

Exploitation requires the ability to run an Owner-installed Surrealism module. A malicious module can continuously write stdout or stderr without newline characters to consume host memory.

Q: Are deployments affected by default?

The issue affects SurrealDB versions from 3.1.0 before 3.3.0 when Surrealism modules can be installed and run by an Owner. The provided information does not establish whether any default deployment includes such modules.

Q: What is the operational impact?

The module output buffering can exhaust server memory and crash the SurrealDB server. This causes denial of service across all namespaces and databases on that server.

Q: Does configuring a module memory limit prevent exploitation?

No. The unbounded buffering of module stdout and stderr occurs in host memory and bypasses the configured module memory limit.

Published Oct 12, 2026

Updated

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.

Affected Software

1 affected component

SurrealDB SurrealDB>=3.1.0<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SurrealDB to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires the ability to run an Owner-installed Surrealism module. A malicious module can continuously write stdout or stderr without newline characters to consume host memory.

Are deployments affected by default?

The issue affects SurrealDB versions from 3.1.0 before 3.3.0 when Surrealism modules can be installed and run by an Owner. The provided information does not establish whether any default deployment includes such modules.

What is the operational impact?

The module output buffering can exhaust server memory and crash the SurrealDB server. This causes denial of service across all namespaces and databases on that server.

Does configuring a module memory limit prevent exploitation?

No. The unbounded buffering of module stdout and stderr occurs in host memory and bypasses the configured module memory limit.

CVE-2026-109339: SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What is the operational impact?

Does configuring a module memory limit prevent exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected by default?

What is the operational impact?

Does configuring a module memory limit prevent exploitation?