Allocation of Resources Without Limits or Throttling Affecting surrealdb package, versions <3.1.0-beta.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-SURREALDB-17797687
- published2 Jul 2026
- disclosed1 Jul 2026
- creditUnknown
Introduced: 1 Jul 2026
New CVE NOT AVAILABLE CWE-770 (opens in a new tab)How to fix?
Upgrade surrealdb to version 3.1.0-beta.3 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the /sql WebSocket upgrade process. An attacker can exhaust system memory and degrade service availability by streaming excessively large WebSocket frames to anonymous connections, bypassing operator-configured per-connection message size limits. This can lead to process termination on memory-constrained deployments if sufficient bandwidth is maintained across multiple concurrent connections.
Workaround
This vulnerability can be mitigated by refusing GET /sql requests with Upgrade: websocket at a reverse proxy, or by enforcing per-connection frame size limits at the reverse proxy.