CVE-2026-109339 surrealdb CVE debrief

Who should care

Defenders responsible for SurrealDB deployments should assess exposure and prioritize verification and remediation. This includes reviewing and limiting Surrealism module output buffering, monitoring server memory usage, and implementing alerts. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is

Why it matters

Defenders should care about this vulnerability because it can lead to denial of service and potential memory exhaustion in SurrealDB deployments. Verification of versions and remediation are necessary to mitigate this vulnerability.

• Denial of service to all namespaces and databases
• Potential for memory exhaustion and server crash
• Need for verification of SurrealDB versions and remediation

Technical summary

The vulnerability exists in SurrealDB versions 3.1.0 before 3.3.0 and is caused by unbounded buffering of Surrealism module output in host memory. An attacker can exploit this vulnerability to crash the server, denying service to all namespaces and databases. The vulnerability is due to the lack of proper output buffering limits in the Surrealism module, allowing an attacker to write output without newlines and cause a denial of service. Defenders should prioritize verifying SurrealDB versions and upgrading to 3.3.0 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying SurrealDB versions and upgrading to 3.3.0 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify SurrealDB version and upgrade to 3.3.0 or later
• Review and limit Surrealism module output buffering
• Monitor server memory usage and implement alerts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by unbounded buffering of Surrealism module output in host memory, which can lead to memory exhaustion and denial of service. The Surrealism module output is not properly limited, allowing an attacker to write output without newlines and cause a denial of service. Defenders should verify SurrealDB versions and review module output buffering to mitigate this vulnerability. The CVE record and vendor advisory provide additional context for defenders to assess exposure and prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.