Live › vulnerability › CVE-2026-121417
SurrealDB before 3.3.0 has a use-after-free bug in its key-value storage backends, which can be triggered when a Rust program leaks a dispatched future and then drops the transaction. The result is that pool workers read and write freed memory, risking crashes or memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Systems that run SurrealDB before 3.3.0, or embed the surrealdb-core Rust crate, with KV storage backends. The risky path is Rust embedders that leak a dispatched future and then drop the transaction; a standalone server that only receives queries over its normal interface is less clearly exposed, and the sources do not say how reachable it is from the network. Teams on managed hosting or on 3.3.0 or later can skip it.
No product ranges from the sources yet.
surreal version, and compare it to 3.3.0.surrealdb-core is pinned below 3.3.0 in Cargo.lock.mem::forget) before dropping a transaction.surrealdb-core to 3.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.
This page as .md · .json · in your agent: get_signal("CVE-2026-121417")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.