CVE-2026-121423

6.5 MEDIUMpublic exploit available

Published 2026-11-03 · Updated 2026-11-03

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-674

Public exploit & PoC references

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg

All references

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg
https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-dos-via-unbounded-recursion-in-val-value-serialization

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100354PoC
MEDIUMCVE-2026-100702PoC
MEDIUMCVE-2026-101180
MEDIUMCVE-2026-102265PoC
HIGHCVE-2026-102276PoC
HIGHCVE-2026-102278PoC
HIGHCVE-2026-102281PoC
MEDIUMCVE-2026-102409

Related by shared AI tags and CWE weakness class. Browse the full archive.