These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-63734 is a denial of service vulnerability in SurrealDB versions before 3.2.0. The vulnerability is located in the SurrealML header parser and allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other malformed header fields that trigger unchecked unwrap calls, causing a pan [truncated]
CVE-2026-63733 is a permissions bypass vulnerability in SurrealDB versions before 3.2.0. The vulnerability allows attackers with permission to perform a guarded operation to write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption. This vulnerability has a CVSS score of 5.3 and a severity of [truncated]
CVE-2026-63762 is a denial of service vulnerability in SurrealDB's embedded JavaScript scripting engine, enabled via the --allow-scripting capability. Users with query execution capabilities can trigger a null pointer dereference, causing the server process to terminate immediately. This vulnerability affects users who have enabled --allow-scripting or --allow-guests. The issue was addressed by updating t [truncated]
CVE-2026-63761 is a medium-severity vulnerability affecting SurrealDB before version 3.1.0. The issue arises when a JWT access method is configured with the ES512 algorithm, which is silently substituted with ES384 due to limitations in the underlying jsonwebtoken crate. This substitution leads to authentication handshake failures for users who provide the correct P-521 key for ES512, as ES384 expects a P [truncated]
CVE-2026-63755 is a high-severity vulnerability in SurrealDB, a database management system. The vulnerability allows an authenticated user, including Record and Scope users, to bypass table-level permission checks and read the full contents of any table in the database they are authenticated against. This is achieved by exploiting the ordering flaw in the evaluation of user-supplied WHERE clauses in SELEC [truncated]
CVE-2026-63752 is an authorization bypass vulnerability in SurrealDB before version 3.1.0. The vulnerability exists in the RELATE statement, allowing authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. This can be exploited by issuing a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite [truncated]
CVE-2026-63751 is a field-level permission bypass vulnerability in SurrealDB versions before 3.1.0. The vulnerability allows authenticated users to read protected fields using JSON Patch operations. Specifically, attackers can exploit this vulnerability by using UPDATE PATCH with an empty 'from' pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SE [truncated]
CVE-2026-63746 is a high-severity vulnerability in SurrealDB versions before 3.1.0. The issue allows authenticated users to read records from any table reachable through graph edges, regardless of the target table's SELECT permissions. This occurs due to a failure in enforcing table SELECT permissions when traversing graph edges or back-references. The vulnerability has significant implications for data a [truncated]
CVE-2026-63745 is an authorization bypass vulnerability in SurrealDB versions before 3.1.0. Authenticated users can spoof composite record-id field values by writing to editable body fields, bypassing permission rules that gate access on id components like tenant isolation. This vulnerability has a CVSS score of 5.3 and is considered Medium severity. Users of SurrealDB versions before 3.1.0 should apply p [truncated]
SurrealDB fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions, allowing an authenticated user to bypass network access controls and potentially retrieve or alter sensitive information. This vulnerability affects SurrealDB versions before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier). Defenders should assess exposure and prioritize reme [truncated]
CVE-2024-58370 is a high-severity vulnerability in SurrealDB, a database management system. The vulnerability exists due to the lack of recursion depth limits when parsing nested SurrealQL statements, including IF, RELATE, and attribute access idioms. This can be exploited by authorized attackers to submit queries with excessive nesting depth, causing a stack overflow and crashing the server. The vulnerab [truncated]
CVE-2024-58369 is a high-severity vulnerability in SurrealDB versions before 1.1.1, caused by inadequate validation of custom parameters and functions. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service. The vulnerability has a CVSS score of 7.1 and is classified as HIGH. Affected users should prioritize updates to prevent poten [truncated]
SurrealDB versions before 1.1.0 are vulnerable to a denial-of-service attack due to improper parsing of ID, DB, and NS headers in HTTP REST API requests containing special characters. This issue allows unauthenticated attackers to send crafted HTTP requests that trigger an uncaught exception, causing the server to crash. The vulnerability has a high CVSS score of 8.7, indicating a significant risk to affe [truncated]
CVE-2024-58367 is a high-severity vulnerability in SurrealDB versions before 2.0.4, allowing authorized users to access unauthorized field values through various query techniques. The vulnerability has a CVSS score of 7.1 and is classified as HIGH. This issue affects SurrealDB deployments, and users should review official advisories to validate affected scope, severity, and vendor guidance. The CVE record [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-18T14:17:09.460Z and has not been modified since then. SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-18T14:17:09.320Z and has not been modified since then. The vulnerability affects SurrealDB versions before 1.2.1 and involves an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. This could lead to denial of service attacks if [truncated]
CVE-2024-58363 is a medium-severity vulnerability in SurrealDB, a database management system. The issue arises from improper authentication validation when a user switches databases using the USE clause or use method. An attacker with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists. This can lead to unauthorized action [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-18T14:17:09.047Z and has not been modified since then. SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. This allows an unauthenticated attacker to enco [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-18T14:17:08.917Z and has not been modified since then. SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. This vulnerability allows authorized clients to execute malformed queries that cause a panic i [truncated]
A denial of service vulnerability exists in SurrealDB versions before 2.1.0. The vulnerability is triggered when using the ORDER BY rand() clause, which can cause a panic in the sorting function, resulting in a server crash. This issue can be exploited by authorized clients executing specific queries. The vulnerability has a CVSS score of 7.1 and is rated as HIGH. Users of SurrealDB versions before 2.1.0 [truncated]
CVE-2024-58358 is a denial of service vulnerability in SurrealDB versions before 2.1.0. Privileged owner users can define users with nonexistent roles, which can be exploited by attackers to trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server. The vulnerability has a CVSS score of 6.9 and a severity of MEDIUM. The vulnerability exists in the role conversion pr [truncated]
CVE-2024-58357 is an uncaught exception vulnerability in SurrealDB versions before 2.1.0. The vulnerability exists in the rand::time() function, which panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliably trigger server panics and cause denial of service. The CVSS score for this vulnerability is 7.1, indicating a high severity. [truncated]
CVE-2023-54366 is a high-severity vulnerability in SurrealDB, a database management system. The vulnerability arises from SurrealDB's default setting of table permissions to FULL instead of NONE, allowing for SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. This issue affects SurrealDB versions before 1.0.1 and can be exploited by attackers with database access or unau [truncated]
Authenticated users with OWNER or EDITOR permissions in SurrealDB can define custom database functions using nested FOR loops, potentially leading to denial-of-service attacks by consuming all server CPU time. This vulnerability affects SurrealDB versions before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2. The issue allows an attacker to execute a function that consumes all server CPU time, renderin [truncated]
This PatchSiren debrief is based on CVE-2025-71396, which describes a denial-of-service vulnerability in SurrealDB versions before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2. The vulnerability occurs when the scripting capability is explicitly enabled, allowing an authenticated attacker to submit long-running JavaScript functions to exhaust server resources.
A memory exhaustion vulnerability exists in SurrealDB versions before 2.2.2 in the string::replace function. This vulnerability allows an authenticated attacker to craft a malicious query that can exhaust server memory through unbounded string allocations, causing a denial of service. The vulnerability has a high severity score and requires immediate attention from database administrators and security tea [truncated]
Authenticated attackers can bypass recursion limits in SurrealDB before 2.2.2 with scripting enabled, causing memory exhaustion via nested native and JavaScript function calls. This vulnerability allows attackers to trigger infinite recursion, leading to potential service disruption and memory exhaustion. Defenders should assess exposure and prioritize patching or mitigation, especially for instances with [truncated]
CVE-2025-71392 is a critical vulnerability in SurrealDB, a database management system. The vulnerability allows an authenticated System User with OWNER or EDITOR roles to create tables or fields with malicious names containing SurrealQL, which can be executed when a higher-privileged user imports the exported backup, enabling privilege escalation and root-level takeover of the SurrealDB instance.
CVE-2026-63309 is a medium-severity vulnerability in SurrealDB, a database management system. The issue arises from the failure to apply field-level SELECT permissions to ORDER BY clauses in versions prior to 3.1.5. This oversight allows authenticated users to infer the relative ordering of restricted field values by issuing ORDER BY queries on indexed restricted fields. Consequently, attackers can recove [truncated]
