CVE-2026-63759: Surrealdb

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.

Affected products

• Surrealdb Surrealdb: before 3.1.0 (fixed in 3.1.0)

Published 2026-07-20. Last modified 2026-07-23.