CVE-2026-109339

4.9Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.9Medium

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: High impact on availability
Weakness: CWE-770

Impact

Authenticated attackers with execution rights can crash the entire database server via an out-of-memory condition. This requires Owner-level access to install or run a malicious Surrealism module.

Root cause

Surrealism module stdout and stderr output is buffered without bounds in host memory if newline characters are omitted, bypassing module memory caps.

Affected systems

SurrealDB 3.1.0 before 3.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade to SurrealDB 3.3.0 or later. As an interim workaround, restrict Owner access and do not install or run untrusted Surrealism modules.

shell

$ surreal version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109339