CVE-2026-63750 surrealdb CVE debrief

Who should care

Users of SurrealDB, especially those using versions before 3.1.0, should be aware of this vulnerability. It's crucial for administrators and developers to assess their exposure and take necessary actions to mitigate potential risks. They should review their systems for exposure, verify the vulnerability's impact, and implement necessary mitigations. Security teams should also be aware of this vulnerability and its implications on their systems.

Technical summary

The vulnerability exists in the WebSocket connection handling of SurrealDB, specifically in the enforcement of the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit for anonymous /sql WebSocket connections. This limit is not applied, allowing attackers to stream large WebSocket frames across multiple concurrent connections. Consequently, this could lead to excessive memory consumption and degradation of /sql service availability. The vulnerability can be mitigated by upgrading to SurrealDB version 3.1.0 or later, implementing compensating controls to limit WebSocket frame sizes, monitoring for unusual WebSocket activity, and reviewing and adjusting SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE settings according to system requirements.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it could lead to denial-of-service conditions and potential memory amplification attacks. The priority is medium because the vulnerability can be exploited to cause significant impact, but it may require specific conditions to be met. Administrators and developers should prioritize patching or mitigating this vulnerability to prevent potential attacks. Compensating controls, such as rate limiting and monitoring, should also be implemented to reduce the risk of exploitation.

Recommended defensive actions

• Upgrade to SurrealDB version 3.1.0 or later
• Implement compensating controls to limit WebSocket frame sizes
• Monitor for unusual WebSocket activity
• Review and adjust SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE settings
• Consider implementing rate limiting for WebSocket connections

Evidence notes

The CVE record and NVD entry provide information about this vulnerability. Additional details are available from Vulncheck's advisory. However, the exact scope of affected systems and potential exploitability are not extensively documented in the provided sources. The vulnerability has been publicly disclosed, and users are advised to review their systems for exposure. Defenders should verify the vulnerability's impact on their specific environments and take necessary actions to mitigate potential risks. The SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit should be reviewed and adjusted according to the system's requirements. Monitoring for unusual WebSocket activity is also recommended.

Official resources