CVE-2026-63734 surrealdb CVE debrief

Who should care

Users of SurrealDB versions before 3.2.0 should be aware of this vulnerability and take steps to mitigate it. This includes restricting access to the /ml/import endpoint and validating user input. Additionally, administrators should review their incident response plans to address potential denial of service attacks and ensure that they have the necessary tools and procedures in place to detect and respond to such incidents.

Technical summary

The vulnerability is caused by a lack of input validation in the SurrealML header parser. When a malformed .surml file is uploaded to the /ml/import endpoint, the server attempts to parse the file and crashes due to unchecked unwrap calls. This results in a denial of service, affecting all databases on the server. The issue arises from the parser's inability to handle non-numeric input-dimensions or other malformed header fields, leading to a panic that aborts the entire server process.

Defensive priority

High

Recommended defensive actions

• Restrict access to the /ml/import endpoint to only trusted users
• Validate user input to ensure it conforms to expected formats
• Implement additional logging and monitoring to detect potential attacks
• Consider upgrading to SurrealDB version 3.2.0 or later
• Review and update incident response plans to address potential denial of service attacks
• Perform vulnerability scanning to identify exposed systems
• Establish a remediation timeline based on risk assessment and vendor guidance

Evidence notes

The CVE record was published on 2026-07-20T12:19:42.413Z and last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. The vulnerability was reported by Vulncheck and has a CVSS score of 6.9. There is limited information available about the specific details of the vulnerability, and further analysis is required to fully understand the impact.

Official resources