Live › vulnerability › CVE-2026-121423
SurrealDB before 3.3.0 recurses without limit on deeply nested values, so a stack overflow aborts the surreal process. An authenticated user can repeat UPDATE and SELECT or EXPORT statements to keep the database down for every tenant.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running a self-hosted or shared SurrealDB server before 3.3.0 where more than one tenant or untrusted user holds valid credentials. Single-tenant deployments where only trusted users can log in carry less exposure. unknown whether the sources name specific deployment modes beyond this.
No product ranges from the sources yet.
surreal version; versions below 3.3.0 are in range.3.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.
This page as .md · .json · in your agent: get_signal("CVE-2026-121423")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.