CVE-2026-63737 — MEDIUM (6.5)

Q: How severe is CVE-2026-63737?

CVE-2026-63737 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-63737?

Check the references section above for vendor advisories and patch information. Affected products include: Surrealdb Surrealdb.

Vulnerability Description

SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Surrealdb	Surrealdb	>= 3.0.0, < 3.1.5

Related Weaknesses (CWE)

CWE-674

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jv2j-mqmw-xvv5Vendor AdvisoryMitigation
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-deepThird Party Advisory

FAQ

What is CVE-2026-63737?

CVE-2026-63737 is a vulnerability with a CVSS score of 6.5 (MEDIUM). SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries ...

How severe is CVE-2026-63737?

CVE-2026-63737 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-63737?

Check the references section above for vendor advisories and patch information. Affected products include: Surrealdb Surrealdb.