Cyber Resilience

CVE-2026-63759

DoS in Surrealdb ≤ 3.1.0

Public PoCDoS
Published
20 July 2026
Modified
23 July 2026
Patch / advisory
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0025 17th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-63759 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Surrealdb Surrealdb. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The vulnerability allows authenticated attackers to crash the SurrealDB server via uncontrolled recursion in the type parser, directly enabling Endpoint DoS through application exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-63737Same product: Surrealdb Surrealdb
CVE-2026-63760Same product: Surrealdb Surrealdb
CVE-2026-63750Same product: Surrealdb Surrealdb
CVE-2026-63747Same product: Surrealdb Surrealdb
CVE-2026-63762Same product: Surrealdb Surrealdb
CVE-2026-63754Same product: Surrealdb Surrealdb
CVE-2026-63734Same product: Surrealdb Surrealdb
CVE-2026-63736Same product: Surrealdb Surrealdb
CVE-2026-63757Same product: Surrealdb Surrealdb
CVE-2026-63733Same product: Surrealdb Surrealdb

Affected Assets

surrealdb
surrealdb
≤ 3.1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
Detect
Catch it (NIST detect / respond)
  • SI-2 Flaw Remediation
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces validation of input structure (nested type annotations) to reject excessive recursion depth before memory exhaustion occurs.

prevent

Requires mechanisms to protect against resource exhaustion DoS attacks that exploit uncontrolled recursion in query parsing.

respond

Mandates timely application of patches that add the missing recursion depth limits in the type/kind parser.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent coding errors such as missing recursion limits or termination conditions.

DE.CM-09 partial match
prevents

Runtime monitoring of compute resources can detect excessive consumption caused by uncontrolled recursion.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover and record uncontrolled recursion flaws before deployment.

PR.IR-04 partial match
prevents

Capacity monitoring and resource provisioning can absorb or limit the impact of runaway recursion.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect excessive recursion via static analysis or fuzzing.

prevents

Secure development life cycle requires controls that prevent uncontrolled recursion through design and code review.

prevents

Application security requirements can mandate recursion limits or stack-depth checks.

prevents

Secure system architecture principles include resource-management and input-validation rules that limit recursion.

prevents

Secure coding standards directly prohibit or constrain recursive constructs that could exhaust stack or memory.

detects

Capacity management includes monitoring and limits that mitigate resource exhaustion from runaway recursion.

References