{"answers":{"affected":"2 open source packages ship an affected version, including surrealdb.","exploited":"There is no known exploitation of GHSA-65rj-r9fh-jp2v in the wild and no public exploit code.","fix":"Upgrade surrealdb to 3.1.0 or later.","what":"GHSA-65rj-r9fh-jp2v is a denial of service vulnerability in surrealdb, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-65rj-r9fh-jp2v and fix it if it is affected.\n\nWhat it is: GHSA-65rj-r9fh-jp2v is a denial of service vulnerability in surrealdb, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-65rj-r9fh-jp2v in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- surrealdb (crates.io): affected all versions; fixed in 3.1.0\n- surrealdb (crates.io): affected all versions; fixed in 3.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-65rj-r9fh-jp2v/ (Markdown: https://insights.sbomify.com/GHSA-65rj-r9fh-jp2v/index.md)","id":"GHSA-65rj-r9fh-jp2v","markdown":"https://insights.sbomify.com/GHSA-65rj-r9fh-jp2v/index.md","name":"GHSA-65rj-r9fh-jp2v","record":{"aliases":[],"analysis":{"component_type":"database","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"SurrealDB database","requires_auth":"none","summary":"Anonymous attackers can exhaust memory via oversized WebSocket frames, causing denial of service in SurrealDB deployments.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"An anonymous caller could degrade `/sql` availability by streaming WebSocket frames many times larger than the operator-configured per-connection limit. The `/sql` upgrade handler accepted anonymous connections and did not propagate `SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE` to the WebSocket protocol layer — incoming bytes accumulated in the per-connection read buffer before `check_anon` could reject the query, so the memory cost was incurred regardless of whether the caller could ever execute SurrealQL. The same upgrade path also silently ignored `--deny-http sql` and `--deny-arbitrary-query *` for authenticated callers, but that secondary effect does not grant new permissions.\n\n### Impact\n\n`SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE` is not applied to anonymous `/sql` connections, so each connection can buffer up to the WebSocket library defaults (16 MiB per frame, 64 MiB per reassembled message) of in-flight bytes regardless of the operator's configured limit. Holding this much memory pinned requires actively streaming bytes into the connection, so an attacker has to maintain bandwidth across many concurrent connections to consume meaningful memory. Within that constraint the result is degraded availability for legitimate `/sql` clients; on memory-constrained deployments the process may be OOM-killed and restarted during the attack rather than denied service outright.\n\nSeparately, `--deny-http sql` and `--deny-arbitrary-query *` were not enforced on the WebSocket, so SurrealQL operations the operator had configured to refuse could still be issued by any authenticated principal that already held the corresponding data permissions. This is a configuration-correctness defect — the bypass does not grant new permissions.\n\n### Patches\n\nA patch has been introduced that performs the two capability checks before calling `on_upgrade` and applies the same per-connection size limits used by `/rpc`. The capability checks enforce the operator's configured deny flags; they do not change what any authenticated principal is permitted to do.\n\n- Versions 3.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update should refuse `GET /sql` requests carrying `Upgrade: websocket` at a reverse proxy, or apply per-connection frame size limits at the reverse proxy.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames","id":"GHSA-65rj-r9fh-jp2v","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["3.1.0"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":null,"source":"GHSA-65rj-r9fh-jp2v"},{"ecosystem":"crates.io","fixed":["3.1.0"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":"pkg:cargo/surrealdb","source":"GHSA-65rj-r9fh-jp2v"}],"products":null,"published":"2026-07-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Anonymous attackers can exhaust memory via oversized WebSocket frames, causing denial of service in SurrealDB deployments.","url":"https://insights.sbomify.com/GHSA-65rj-r9fh-jp2v/"}