CVE-2026-63737: SurrealDB before 3.1.5 Denial of Service via deep operator chains
SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63737?
The severity of CVE-2026-63737 is rated high with a score of 7.1.
How do I fix CVE-2026-63737?
To fix CVE-2026-63737, upgrade SurrealDB to version 3.1.5 or later.
What types of attacks does CVE-2026-63737 allow?
CVE-2026-63737 allows authenticated users to launch denial of service attacks by submitting queries with long chains of operators.
Which software is affected by CVE-2026-63737?
CVE-2026-63737 affects SurrealDB versions before 3.1.5.
What is the impact of exploiting CVE-2026-63737?
Exploiting CVE-2026-63737 can lead to a denial of service, crashing the SurrealDB server.