Advisoriesby Ibis
SurrealDB security advisories
55 advisories · 8 critical or high in 12 months · latest Oct 19
55 advisories
Use-after-free in KV backends via leaked `affinitypool::spawn_local` futureCVE-2026-121417fixed in 3.3.0SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL pathCVE-2026-63735fixed in 3.2.0SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record usersCVE-2026-63740fixed in 3.1.4SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deletedCVE-2026-49997fixed in 3.1.0SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitationCVE-2026-63761fixed in 3.1.0SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast pathsCVE-2026-63742fixed in 3.1.0SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorizationCVE-2026-63741fixed in 3.1.0SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirectCVE-2026-63743fixed in 3.1.0SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptionsCVE-2026-63749fixed in 3.1.0SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permissionCVE-2026-63752fixed in 3.1.0SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`CVE-2026-63751fixed in 3.1.0SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messagesCVE-2026-63748fixed in 3.1.0SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controlsCVE-2026-63753fixed in 3.1.0SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket framesCVE-2026-63750fixed in 3.1.0SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live QueriesCVE-2026-63758fixed in 3.1.0SurrealDB: unchecked exceptional conditionCVE-2026-63754fixed in 3.1.0SurrealDB has an Authorization Bypass via Composite Record-id PathsCVE-2026-63745fixed in 3.1.0SurrealDB: Graph traversal bypasses table SELECT permissionsCVE-2026-63746fixed in 3.1.0SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth levelCVE-2026-63755fixed in 3.1.0SurrealDB vulnerable to Denial of Service due to nested types annotationsCVE-2026-63759fixed in 3.1.0SurrealDB has unauthenticated remote DoS via malformed RPC `use` callCVE-2026-63747fixed in 3.1.0SurrealDB has Denial of Service in JSON parser due to nested objectsCVE-2026-63760fixed in 3.1.0SurrealDB: HTTP RPC Session Race Condition Allows Privilege EscalationCVE-2026-63756fixed in 3.1.0SurrealDB: session fixationCVE-2026-63757fixed in 3.1.0SurrealDB: Denial of Service via deep operator chainsCVE-2026-63737fixed in 3.1.5SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversalsCVE-2026-63738fixed in 3.1.5SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted fieldCVE-2026-63309fixed in 3.1.5SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filterCVE-2026-63739fixed in 3.1.5SurrealDB: SSRF via JWKS URL , Redirect Following in JWT Key FetchCVE-2026-63744fixed in 3.1.5SurrealDB vulnerable to Denial of Service through scripting function memory edge caseCVE-2026-63762fixed in 2.6.1 +1SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and FunctionsCVE-2026-63763fixed in 2.5.0 +1SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)CVE-2025-71398fixed in 2.0.5 +2SurrealDB CPU exhaustion via custom functions result in total DoSCVE-2025-71397fixed in 2.0.5 +2SurrealDB no JavaScript script function default timeout could facilitate DoSCVE-2025-71396fixed in 2.0.5 +2SurrealDB memory exhaustion via string::replace using regexCVE-2025-71395fixed in 2.0.5 +2SurrealDB server-takeover via SurrealQL injection on backup importCVE-2025-71392fixed in 2.0.5 +2SurrealDB has local file read of 2-column TSV files via analyzersCVE-2025-71394fixed in 2.1.5 +1SurrealDB vulnerable to memory exhaustion via nested functions and scriptsCVE-2025-71393fixed in 2.0.5 +2SurrealDB has uncaught exception in Net module that leads to database crashCVE-2025-71391fixed in 2.0.5 +2SurrealDB has Silent Failure to Overwrite Table Definition of Relation TypeCVE-2024-58356fixed in 2.1.4SurrealDB has an Uncaught Exception Sorting Tables by Random OrderCVE-2024-58359fixed in 2.1.0SurrealDB has an Uncaught Exception Handling Nonexistent RoleCVE-2024-58358fixed in 2.1.0SurrealDB has an Uncaught Exception in Function Generating Random TimeCVE-2024-58357fixed in 2.1.0SurrealDB: Improper Authorization in Select PermissionsCVE-2024-58367fixed in 2.0.4SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty StringsCVE-2024-58361fixed in 2.0.4Untrusted Query Object Evaluation in RPC APICVE-2024-58362fixed in 1.5.5 +1SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope UserCVE-2024-58363fixed in 1.5.4 +1Externally Controlled Format String in Scripting FunctionsCVE-2024-58366fixed in 1.1.1Uncaught Exception in Macro Expecting Native Function to ExistCVE-2024-58365fixed in 1.2.0Uncaught Exception Handling Parsing Errors on Line TerminatorsCVE-2024-58364fixed in 1.2.1SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket InterfaceGHSA-58j9-j2fj-v8f4fixed in 1.1.0Uncontrolled Recursion in SurrealQL ParsingCVE-2024-58370fixed in 1.1.0Uncaught Exception processing HTTP Headers in SurrealDBCVE-2024-58368fixed in 1.1.0Uncaught Exception in surrealdbCVE-2024-58369fixed in 1.1.1SurrealDB: Full Table Permissions by DefaultCVE-2023-54366fixed in 1.0.1