Uncontrolled Recursion Affecting surrealdb package, versions <3.1.0-beta.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-SURREALDB-17797662
- published2 Jul 2026
- disclosed1 Jul 2026
- creditUnknown
Introduced: 1 Jul 2026
New CVE NOT AVAILABLE CWE-674 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade surrealdb to version 3.1.0-beta.1 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Recursion in the parse_value and parse_json process. An attacker can exhaust server memory and cause a crash by sending a deeply nested JSON payload to the WebSocket /rpc endpoint. This is only exploitable if the attacker has network access to the WebSocket /rpc endpoint.
Workaround
This vulnerability can be mitigated by restricting network access to the WebSocket /rpc endpoint to trusted clients.