{"id":"CVE-2026-121417","kind":"vulnerability","aliases":["CVE-2026-121417"],"related":[],"title":"SurrealDB: use-after-free in storage backends can crash or corrupt memory","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","summary":"SurrealDB before 3.3.0 has a use-after-free bug in its key-value storage backends, which can be triggered when a Rust program leaks a dispatched future and then drops the transaction. The result is that pool workers read and write freed memory, risking crashes or memory corruption.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","package","rust","self-hosted","surrealdb"],"not_affected_if":["managed-hosting","version-3.3.0-or-later"],"how_to_check":"- Check the SurrealDB version in use, for example with `surreal version`, and compare it to `3.3.0`.\n- If the database is embedded as a Rust crate in your own code, check whether `surrealdb-core` is pinned below `3.3.0` in `Cargo.lock`.\n- Check whether your Rust code can leak a future (for example with `mem::forget`) before dropping a transaction.","fix":"- Move SurrealDB and `surrealdb-core` to `3.3.0` or later.","status":"open","published_at":"2026-11-03T15:17:31+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","triaged_at":"2026-11-03T15:22:28+00:00","updated_at":"2026-11-03T15:22:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T15:22:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move SurrealDB and `surrealdb-core` to `3.3.0` or later.","reach":"unknown","title":"SurrealDB: use-after-free in storage backends can crash or corrupt memory","impact":"high","summary":"SurrealDB before 3.3.0 has a use-after-free bug in its key-value storage backends, which can be triggered when a Rust program leaks a dispatched future and then drops the transaction. The result is that pool workers read and write freed memory, risking crashes or memory corruption.","audience":"businesses","category":"package","nicknames":[],"who_cares":["surrealdb","rust","self-hosted","embedded"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Memory corruption or crashes in the database process","analyst_note":"Check the vendor advisory and patch linked from the sources to confirm which deployment modes and query paths are actually reachable.","how_to_check":"- Check the SurrealDB version in use, for example with `surreal version`, and compare it to `3.3.0`.\n- If the database is embedded as a Rust crate in your own code, check whether `surrealdb-core` is pinned below `3.3.0` in `Cargo.lock`.\n- Check whether your Rust code can leak a future (for example with `mem::forget`) before dropping a transaction.","plain_action":"","needs_analyst":true,"not_affected_if":["version-3.3.0-or-later","managed-hosting"],"who_is_affected":"Systems that run SurrealDB before 3.3.0, or embed the surrealdb-core Rust crate, with KV storage backends. The risky path is Rust embedders that leak a dispatched future and then drop the transaction; a standalone server that only receives queries over its normal interface is less clearly exposed, and the sources do not say how reachable it is from the network. Teams on managed hosting or on 3.3.0 or later can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4222,"output_tokens":696,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121417':16A,19A '-2026':15A,18A '3.3.0':29B,79C 'affinitypool':99C 'backend':8A,43B,92C 'borrow':95C 'bug':36B 'caus':124C 'closur':102C 'contain':80C 'core':90C 'corrupt':12A,76B,137C 'crash':10A,73B,134C 'cve':14A,17A 'dispatch':54B,114C 'drop':58B,106C,121C 'e.g':116C 'embed':20B 'embedd':110C 'forget':119C 'free':5A,35B,85C 'freed':70B,131C 'futur':55B,105C,115C 'host':25B 'key':40B 'key-valu':39B 'kv':91C 'leak':52B,112C 'local':101C 'mem':118C 'memori':13A,71B,75B,132C,136C 'packag':21B 'pass':94C 'pool':65B,125C 'program':51B 'read':67B,128C 'reli':103C 'result':62B 'risk':72B,133C 'rust':22B,50B,109C 'safeti':108C 'self':24B 'self-host':23B 'spawn':100C 'state':97C 'storag':7A,42B 'surrealdb':1A,26B,27B,77C,89C 'surrealdb-cor':88C 'transact':60B,96C,123C 'trigger':47B 'use':3A,33B,83C 'use-after-fre':2A,32B,82C 'valu':41B 'via':117C 'vulner':86C 'worker':66B,126C 'write':69B,130C","nicknames":[],"mitigations":[],"who_affected":"Systems that run SurrealDB before 3.3.0, or embed the surrealdb-core Rust crate, with KV storage backends. The risky path is Rust embedders that leak a dispatched future and then drop the transaction; a standalone server that only receives queries over its normal interface is less clearly exposed, and the sources do not say how reachable it is from the network. Teams on managed hosting or on 3.3.0 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","package","rust","selfhosted","surrealdb"],"first_public_at":"2026-10-19T08:52:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121417","severity":null,"published_at":"2026-11-03T15:17:31+00:00","modified_at":"2026-11-03T15:17:31+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","fetched_at":"2026-11-03T15:21:58+00:00","note":null}],"documents":[{"id":58357,"url":"https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58358,"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T08:52:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58359,"url":"https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}