Cyber Resilience

CVE-2026-63760

DoS in Surrealdb ≤ 3.1.0

Public PoCDoS
Published
20 July 2026
Modified
22 July 2026
Patch / advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0036 29th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-63760 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Surrealdb Surrealdb. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server…

more

memory and crash the process.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Unauthenticated exploitation of public WebSocket RPC endpoint via crafted input triggers application DoS through resource exhaustion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-63759Same product: Surrealdb Surrealdb
CVE-2026-63737Same product: Surrealdb Surrealdb
CVE-2026-63736Same product: Surrealdb Surrealdb
CVE-2026-63733Same product: Surrealdb Surrealdb
CVE-2026-63750Same product: Surrealdb Surrealdb
CVE-2026-63747Same product: Surrealdb Surrealdb
CVE-2026-63762Same product: Surrealdb Surrealdb
CVE-2026-63754Same product: Surrealdb Surrealdb
CVE-2026-63744Same product: Surrealdb Surrealdb
CVE-2026-63743Same product: Surrealdb Surrealdb

Affected Assets

surrealdb
surrealdb
≤ 3.1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of input size, structure, and nesting depth to reject excessive JSON payloads before parser recursion occurs.

prevent

Mandates protections that limit resource consumption from unauthenticated inputs to the /rpc endpoint, preventing memory exhaustion via uncontrolled recursion.

prevent

Enforces boundary controls and traffic restrictions on the WebSocket endpoint to reduce exposure to unauthenticated deeply-nested payloads.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent coding errors such as missing recursion limits or termination conditions.

DE.CM-09 partial match
prevents

Runtime monitoring of compute resources can detect excessive consumption caused by uncontrolled recursion.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover and record uncontrolled recursion flaws before deployment.

PR.IR-04 partial match
prevents

Capacity monitoring and resource provisioning can absorb or limit the impact of runaway recursion.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect excessive recursion via static analysis or fuzzing.

prevents

Secure development life cycle requires controls that prevent uncontrolled recursion through design and code review.

prevents

Application security requirements can mandate recursion limits or stack-depth checks.

prevents

Secure system architecture principles include resource-management and input-validation rules that limit recursion.

prevents

Secure coding standards directly prohibit or constrain recursive constructs that could exhaust stack or memory.

detects

Capacity management includes monitoring and limits that mitigate resource exhaustion from runaway recursion.

References