GHSA-xx7m-69ff-9crp CVE-2026-63762
SurrealDB vulnerable to Denial of Service through scripting function memory edge case
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.45%
- Chance of exploitation in the next 30 days. Higher than 39.15% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-476 NULL Pointer Dereference
- Fix
2.6.1- Upgrade surrealdb to this version or later
Description
In SurrealDB instances with the scripting capability enabled (--allow-scripting), users with the ability to run arbitrary queries can trigger a server crash due to a memory-safety bug in the underlying JS engine. The SurrealDB instance terminates instantly, requiring a manual restart.
The query consists of using built-in string functions to construct a large string and passing it to the JavaScript runtime for compilation. The exact string size required to trigger the crash varies between SurrealDB versions.
Whilst exploiting the vulnerability requires users to be able to run arbitrary queries, if guest access (--allow-guests), is enabled, then guests can perform this attack.
Impact
Any user able to execute queries on a SurrealDB instance with scripting enabled (--allow-scripting) can cause complete denial of service. The server process terminates immediately without graceful shutdown.
The underlying cause of the vulnerability is a null pointer dereference in the QuickJS-NG v0.8 JavaScript engine, this vulnerability cannot be exploited to execute arbitrary code, or compromise the integrity or confidentiality of data.
Patches
Versions prior to SurrealDB v2.6.1 and v3.0.0-beta.3 are vulnerable.
The patches for SurrealDB v2.6.1 and v3.0.0-beta.3 update the rquickjs dependency from v0.9.0 to v0.11.0, which in turn uses an updated version of QuickJS-NG.
Workarounds
Deny execution of embedded scripting functions through the configuration of capabilities by starting SurrealDB with the --deny-scripting flag or the equivalent environment variable SURREAL_CAPS_DENY_SCRIPT=true. This has a usability implication, although scripting functions are disabled by default.
Administrators can also use --deny-arbitrary-query to deny arbitrary querying by either guest, record or system users, or a combination of those, with impacts to functionality for those users.
Links
SurrealDB Documentation - Capabilities SurrealDB Documentation - Guest Access SurrealQL Documentation - Scripting Functions quickjs-ng v0.9 Release Notes https://github.com/surrealdb/surrealdb/pull/6833 https://github.com/surrealdb/surrealdb/pull/6774
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| surrealdb | < 2.6.1 |
2.6.1 |
| surrealdb | >= 3.0.0-alpha.8, < 3.0.0-beta.3 |
3.0.0-beta.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
surrealdb crates.io → 2.6.1
- cargo
cargo update -p surrealdb --precise 2.6.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Requirements: Select a programming language that is not susceptible to these issues.
- Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
- Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
References
Advisories
Packages
Other links
- github.com/surrealdb/surrealdb/security/advisories/GHSA-xx7m-69ff-9crp
- github.com/surrealdb/surrealdb/pull/6774
- github.com/surrealdb/surrealdb/pull/6833
- github.com/surrealdb/surrealdb/commit/2b0389b92398d9ecff4632cd51bbf8303832a988
- github.com/surrealdb/surrealdb/commit/bcd2ece9ef0d721215f06a47280698669f332285
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8rw6-p7m8-63jp SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users | High | Also affects surrealdb |
| GHSA-848m-r628-vrxw SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path | High | Also affects surrealdb |
| GHSA-m3c3-78fh-w3w7 SurrealDB allows bypass of deny-net flags via DNS resolution | High | Also affects SurrealDB |
| GHSA-whwg-vh4f-pmmf SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted | Medium | Also affects surrealdb |
| GHSA-fwg2-gr34-q3w8 SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation | Medium | Also affects surrealdb |
| GHSA-c8jx-96c9-8xrp SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths | Medium | Also affects surrealdb |
| GHSA-wp87-mgvq-5j93 SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization | Medium | Also affects surrealdb |
| GHSA-97vg-427p-8hx5 SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect | Medium | Also affects surrealdb |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor