Advisories · Technology
surrealdb.
Every CVE that names surrealdb among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
- surrealdb
- Denial of service
- CVSS 5.1 Medium
SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass
- surrealdb
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass
- surrealdb
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
- surrealdb
- Server-side request forgery (SSRF)
- CVSS 8.6 High
SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision
- surrealdb
- Privilege escalation
- CVSS 5.3 Medium
SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
- surrealdb
- Broken access control
- CVSS 8.8 High
SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends
- surrealdb
- Memory corruption
- CVSS 7.1 High
SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
- surrealdb
- Broken access control
- CVSS 8.6 High
SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement
- surrealdb
- Broken access control
- CVSS 5.3 Medium
SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method
- surrealdb
- Authentication bypass
- CVSS 7.1 High
SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations
- surrealdb
- Information disclosure
- CVSS 5.3 Medium
SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE
- surrealdb
- Broken access control
- CVSS 6.9 Medium
SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering
- surrealdb
- surrealdb surrealism-runtime
- Denial of service
- CVSS 7.1 High
SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values
- surrealdb
- CWE-248
- CVSS 5.3 Medium
SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause
- surrealdb
- Information disclosure
- CVSS 5.3 Medium
SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
- surrealdb
- Broken access control
- CVSS 7.1 High
SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields
- surrealdb
- Information disclosure
- CVSS 8.6 High
SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use
- surrealdb
- Broken access control
- CVSS 7.1 High
SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH
- surrealdb
- Broken access control
- CVSS 8.6 High
SurrealDB before 3.3.0 Cross-Tenant Access via Headers
- surrealdb
- Broken access control
- CVSS 5.1 Medium
SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution
- surrealdb
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import
- surrealdb
- CWE-20