GHSA-rpmq-gq3f-h6jg: SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SurrealDB user can trigger it. The impact can extend to all tenants because crashing the surreald process causes a persistent denial of service.
What actions are required to trigger the crash?
An attacker repeatedly runs UPDATE statements that wrap a stored array in itself to create deeply nested values. They then SELECT or EXPORT the value, causing recursive serialization to overflow the stack and abort the process.
How can defenders identify whether exploitation may have occurred?
Look for repeated UPDATE operations that recursively wrap an existing stored array in itself, followed by SELECT or EXPORT requests targeting the resulting deeply nested value. A surreald process abort consistent with stack overflow after those operations is an indicator.