CVE-2026-63747 — SurrealDB before 3.1.0 Denial of Service via malformed RPC use
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can se…
Published: 2026-07-20 · CVSS: 8.7 · CVSS 4.0
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7