CVE-2026-109338 — SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. …
Published: 2026-10-12 · CVSS: 7.1 · CVSS 4.0
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7