Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-63750— SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket

Quick assessment

Affected

surrealdb surrealdb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

surrealdb是SurrealDB公司开源的一个文档图数据库。 SurrealDB 3.1.0之前版本存在资源管理错误漏洞，该漏洞源于未将SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE限制应用于匿名/sql WebSocket连接，导致攻击者可以在每个连接的读取缓冲区中缓冲无限帧，并通过跨多个并发连接流式传输大于配置限制的WebSocket帧，从而消耗过多内存并降低/sql可用性。

CVSS 5.3 · Medium EPSS 0.49% · P40 Updated Jul 28, 2026

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 2

Vendor	Product	Version Range	Status
surrealdb	surrealdb	`< 3.1.0`	affected
		`3.1.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63750

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket

Source: CVE Program / CVE List V5

Vulnerability Description

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Vulnerability Title

SurrealDB 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
surrealdb	surrealdb	0 ~ 3.1.0	-

II. Public POCs for CVE-2026-63750

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63750

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-63750 (2)

🔗 Pre-auth memory amplification via unbounded `/sql` WebSocket frames · Advisory · surrealdb/surrealdb · GitHub Read full article vendor-advisory
🔗 SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-63750

Same Patch Batch · surrealdb · 2026-07-20 · 31 CVEs total

CVE-2026-63757	8.8 HIGH	SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
CVE-2026-63735	8.1 HIGH	SurrealDB before 3.2.0 Authentication Bypass via Custom API
CVE-2026-63756	8.1 HIGH	SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
CVE-2026-63739	7.7 HIGH	SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER
CVE-2026-63763	7.5 HIGH	SurrealDB before 2.5.0 Privilege Escalation via Future Fields
CVE-2026-63747	7.5 HIGH	SurrealDB before 3.1.0 Denial of Service via malformed RPC use
CVE-2026-63760	7.5 HIGH	SurrealDB before 3.1.0 Denial of Service via JSON Parser
CVE-2026-63755	6.5 MEDIUM	SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
CVE-2026-63759	6.5 MEDIUM	SurrealDB before 3.1.0 Denial of Service nested type annotations
CVE-2026-63740	6.5 MEDIUM	SurrealDB before 3.1.4 Array Element Permission Bypass
CVE-2026-63741	6.5 MEDIUM	SurrealDB before 3.1.0 Authentication Bypass via USE statement
CVE-2026-63737	6.5 MEDIUM	SurrealDB before 3.1.5 Denial of Service via deep operator chains
CVE-2026-63746	6.5 MEDIUM	SurrealDB before 3.1.0 Permission Bypass via Graph Traversal
CVE-2026-63754	6.5 MEDIUM	SurrealDB before 3.1.0 Denial of Service via LIVE Query
CVE-2026-63743	6.4 MEDIUM	SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect
CVE-2026-63762	6.0 MEDIUM	SurrealDB before v2.6.1 Denial of Service via scripting
CVE-2026-63745	5.4 MEDIUM	SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id
CVE-2026-63758	5.4 MEDIUM	SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
CVE-2026-63734	4.9 MEDIUM	SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import
CVE-2026-63748	4.3 MEDIUM	SurrealDB before 3.1.0 Information Disclosure via Error Messages

Showing top 20 of 31 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: surrealdb

Same vendor: surrealdb

Same weakness: CWE-770

V. Comments for CVE-2026-63750

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-63750— SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-63750

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-63750

III. Intelligence Information for CVE-2026-63750

Vendor Advisories for CVE-2026-63750 (2)

Same Patch Batch · surrealdb · 2026-07-20 · 31 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-63750

Leave a comment