CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser

What is CVE-2026-63760?

CVE-2026-63760 is a high-severity denial of service vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

Weakness: CWE-674

Which versions are affected by CVE-2026-63760?

2 open source packages ship an affected version, including surrealdb. It affects 1 product.

Products include Surrealdb Surrealdb.

How do I fix CVE-2026-63760?

Upgrade surrealdb to 3.1.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-63760 being exploited?

There is no known exploitation of CVE-2026-63760 in the wild and no public exploit code.

Other vulnerabilities in Surrealdb Surrealdb

• CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export Critical 9.4
• CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition Critical 9.2
• CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use High 8.7
• CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions High 8.7
• CVE-2023-54366 SurrealDB before 1.0.1 Insecure Default Table Permissions High 8.7

All Surrealdb Surrealdb vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q729-696q-g9pq.