← Database

CVE-2026-63747

HIGH CVSS: 7.5 Published: 2026-07-20 Modified: 2026-07-23

Description

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.

Affected Platforms

Surrealdb Surrealdb

Weakness Type

CWE-248

References