crates.ioPackage

surrealdb

56 known vulnerabilities (3 critical, 26 high, 23 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release: 4.0.0 (Nov 3, 2026): no advisory affects it
Newest unaffected release: 4.0.0 (Nov 3, 2026), the latest release
Advisories: 56 · 3 critical, 26 high, 23 medium, 3 low

Weekly downloads: 44.7K
Dependents: 0
Releases: 130 since 1.0.0 (Sep 13, 2023)
Registry: crates.io
Releases read: Nov 8, 2026

Version timeline

RUSTSEC-2026-0453
Affects 1.0.0-beta.1 to 3.3.0-beta.4 (3.3.0 is outside it)
CVE-2026-63763
Affects 1.0.0-beta.1 to 2.4.1 (2.5.0 is outside it); 3.0.0-alpha.8 to 3.0.0-beta.2 (3.0.0-beta.3 is outside it)
CVE-2026-63762
Affects 1.0.0-beta.1 to 2.6.0 (2.6.1 is outside it); 3.0.0-alpha.8 to 3.0.0-beta.2 (3.0.0-beta.3 is outside it)
CVE-2026-63761
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63760
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63759
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63758
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63757
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63756
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63755
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63754
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63753
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)

Show all 56 advisoriesShow fewer advisories

CVE-2026-63752
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63751
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63750
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63749
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63748
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63747
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63746
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63745
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63744
Affects 1.0.0-beta.1 to 3.1.4 (3.1.5 is outside it)
CVE-2026-63743
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63742
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63741
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2026-63740
Affects 1.0.0-beta.1 to 3.1.3 (3.1.4 is outside it)
CVE-2026-63739
Affects 1.0.0-beta.1 to 3.1.4 (3.1.5 is outside it)
CVE-2026-63738
Affects 3.1.0 to 3.1.4 (3.1.5 is outside it)
CVE-2026-63737
Affects 3.0.0 to 3.1.4 (3.1.5 is outside it)
CVE-2026-63735
Affects 1.0.0-beta.1 to 3.2.0-beta.3 (3.2.0 is outside it)
CVE-2025-71398
Affects 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71397
Affects 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71396
Affects 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71395
Affects 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71394
Affects 1.0.0-beta.1 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71393
Affects 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71392
Affects 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71391
Affects 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it)
CVE-2025-71390
Affects 2.1.0 to 2.1.7 (2.1.8 is outside it); 2.2.0 to 2.2.5 (2.2.6 is outside it); 2.3.0 to 2.3.5 (2.3.6 is outside it)
CVE-2024-58370
Affects 1.0.0-beta.1 to 1.0.2 (1.1.0 is outside it)
CVE-2024-58369
Affects 1.0.0-beta.1 to 1.1.0 (1.1.1 is outside it)
CVE-2024-58368
Affects 1.0.0-beta.1 to 1.0.2 (1.1.0 is outside it)
CVE-2024-58367
Affects 1.0.0-beta.1 to 2.0.3 (2.0.4 is outside it)
CVE-2024-58366
Affects 1.0.0-beta.1 to 1.1.0 (1.1.1 is outside it)
CVE-2024-58365
Affects 1.0.0-beta.1 to 1.1.1 (1.2.0 is outside it)
CVE-2024-58364
Affects 1.0.0-beta.1 to 1.2.0 (1.2.2 is outside it)
CVE-2024-58363
Affects 1.0.0-beta.1 to 1.5.3 (1.5.4 is outside it)
CVE-2024-58362
Affects 1.0.0-beta.1 to 1.5.4 (1.5.5 is outside it)
CVE-2024-58361
Affects 2.0.0 to 2.0.3 (2.0.4 is outside it)
CVE-2024-58359
Affects 1.0.0-beta.1 to 2.0.5 (2.1.0 is outside it)
CVE-2024-58358
Affects 1.0.0-beta.1 to 2.0.5 (2.1.0 is outside it)
CVE-2024-58357
Affects 1.0.0-beta.1 to 2.0.5 (2.1.0 is outside it)
CVE-2024-58356
Affects 2.0.0 to 2.1.3 (2.1.4 is outside it)
CVE-2023-54366
Affects 1.0.0-beta.1 to 1.0.0 (1.0.1 is outside it)
CVE-2026-63309
Affects 3.0.0 to 3.1.4 (3.1.5 is outside it)
CVE-2026-49997
Affects 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it)
CVE-2025-11060
Affects 1.0.0-beta.1 to 2.1.8 (2.1.9 is outside it); 2.2.0 to 2.2.7 (2.2.8 is outside it); 2.3.0 to 2.3.7 (2.3.8 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 56

RUSTSEC-2026-0453Unrated
Use-after-free in KV backends via leaked `affinitypool::spawn_local` future
Affected: fixed in 3.3.0.
Fixed in 3.3.0 (released Sep 24, 2026, 25 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63763High 7.5
SurrealDB before 2.5.0 Privilege Escalation via Future Fields
Affected: fixed in 2.5.0; from 3.0.0-alpha.1, fixed in 3.0.0-beta.3.
Fixed in 2.5.0 (released Jan 22, 2026, 179 days before disclosure) and 3.0.0-beta.3 (released Feb 5, 2026, 165 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63762Medium 6.0
SurrealDB before v2.6.1 Denial of Service via scripting
Affected: fixed in 2.6.1; from 3.0.0-alpha.8, fixed in 3.0.0-beta.3.
Fixed in 2.6.1 (released Feb 12, 2026, 158 days before disclosure) and 3.0.0-beta.3 (released Feb 5, 2026, 165 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63761Medium 5.3
SurrealDB before 3.1.0 Algorithm Downgrade via ES512
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63760High 8.7
SurrealDB before 3.1.0 Denial of Service via JSON Parser
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63759High 7.1
SurrealDB before 3.1.0 Denial of Service nested type annotations
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63758Medium 5.3
SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63757High 8.7
SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63756Critical 9.2
SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63755High 7.1
SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63754High 7.1
SurrealDB before 3.1.0 Denial of Service via LIVE Query
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63753Medium 5.3
SurrealDB before 3.1.0 Authentication Bypass via LIVE Query
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63752Medium 5.3
SurrealDB before 3.1.0 RELATE Statement Record Overwrite
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63751Medium 5.3
SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63750Medium 6.9
SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.

Show all 56 advisoriesShow fewer advisories

CVE-2026-63749Medium 5.3
SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63748Medium 5.3
SurrealDB before 3.1.0 Information Disclosure via Error Messages
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63747High 8.7
SurrealDB before 3.1.0 Denial of Service via malformed RPC use
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63746High 7.1
SurrealDB before 3.1.0 Permission Bypass via Graph Traversal
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63745Medium 5.3
SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63744Medium 5.1
SurrealDB before 3.1.5 SSRF via JWKS URL Redirect
Affected: fixed in 3.1.5.
Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63743Medium 5.3
SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63742Medium 5.3
SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63741Medium 6.9
SurrealDB before 3.1.0 Authentication Bypass via USE statement
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63740High 7.1
SurrealDB before 3.1.4 Array Element Permission Bypass
Affected: fixed in 3.1.4.
Fixed in 3.1.4 (released Jun 10, 2026, 40 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63739High 8.3
SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER
Affected: fixed in 3.1.5.
Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63738Medium 5.3
SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal
Affected: from 3.1.0, fixed in 3.1.5.
Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63737High 7.1
SurrealDB before 3.1.5 Denial of Service via deep operator chains
Affected: from 3.0.0, fixed in 3.1.5.
Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63735High 8.6
SurrealDB before 3.2.0 Authentication Bypass via Custom API
Affected: fixed in 3.2.0.
Fixed in 3.2.0 (released Jul 2, 2026, 18 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71398Medium 5.8
SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass
Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5.
Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71397High 7.1
SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops
Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5.
Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71396Low 2.3
SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting
Affected: from 2.2.0, fixed in 2.2.2; fixed in 2.0.5; from 2.1.0, fixed in 2.1.5.
Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71395High 7.1
SurrealDB before 2.2.2 Memory Exhaustion via string::replace
Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5.
Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71394Low 2.3
SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER
Affected: from 2.2.0, fixed in 2.2.2; fixed in 2.1.5.
Fixed in 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71393Medium 6.0
SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions
Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5.
Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71392Critical 9.4
SurrealDB before 2.2.2 SurrealQL Injection via export
Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5.
Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71391High 7.1
SurrealDB before 2.2.2 Denial of Service via /sql endpoint
Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5.
Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-71390Medium 5.8
SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution
Affected: from 2.1.0, fixed in 2.1.8; from 2.2.0, fixed in 2.2.6; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.7; from 2.3.0, fixed in 2.3.6.
Fixed in 2.1.8 (released Jun 26, 2025, 387 days before disclosure), 2.2.6 (released Jun 25, 2025, 388 days before disclosure), 2.3.6 (released Jun 25, 2025, 388 days before disclosure) and 1 other version.
The latest release, 4.0.0, is not affected.
CVE-2024-58370High 7.1
SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Jan 9, 2024, 921 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58369High 7.1
SurrealDB before 1.1.1 Denial of Service via Global Parameters
Affected: fixed in 1.1.1.
Fixed in 1.1.1 (released Jan 16, 2024, 914 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58368High 8.7
SurrealDB before 1.1.0 Denial of Service via HTTP Headers
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Jan 9, 2024, 921 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58367High 7.1
SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions
Affected: fixed in 2.0.4.
Fixed in 2.0.4 (released Oct 8, 2024, 648 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58366Critical 9.0
SurrealDB before 1.1.1 Format String via Scripting Functions
Affected: fixed in 1.1.1.
Fixed in 1.1.1 (released Jan 16, 2024, 914 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58365High 7.1
SurrealDB before 1.2.0 Denial of Service via Nonexistent Function
Affected: fixed in 1.2.0.
Fixed in 1.2.0 (released Feb 13, 2024, 886 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58364High 7.1
SurrealDB before 1.2.1 Denial of Service via Parsing Error
Affected: fixed in 1.2.1.
Fixed in 1.2.2 (released Mar 7, 2024, 863 days before disclosure, the advisory names 1.2.1, which was never published).
The latest release, 4.0.0, is not affected.
CVE-2024-58363Medium 5.3
SurrealDB before 1.5.4 Authentication Bypass via Database Switch
Affected: fixed in 1.5.4; from 2.0.0-alpha.1, fixed in 2.0.0-alpha.6.
Fixed in 1.5.4 (released Jul 10, 2024, 738 days before disclosure) and 2.0.0 (released Sep 17, 2024, 669 days before disclosure, the advisory names 2.0.0-alpha.6, which was never published).
The latest release, 4.0.0, is not affected.
CVE-2024-58362High 8.7
SurrealDB before 1.5.5 Query Injection via RPC API
Affected: fixed in 1.5.5; from 2.0.0-beta.1, fixed in 2.0.0-beta.3.
Fixed in 1.5.5 (released Sep 11, 2024, 675 days before disclosure) and 2.0.0 (released Sep 17, 2024, 669 days before disclosure, the advisory names 2.0.0-beta.3, which was never published).
The latest release, 4.0.0, is not affected.
CVE-2024-58361High 7.1
SurrealDB before 2.0.4 Denial of Service via Parser Exception
Affected: from 2.0.0, fixed in 2.0.4.
Fixed in 2.0.4 (released Oct 8, 2024, 648 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58359High 7.1
SurrealDB before 2.1.0 Denial of Service via rand() Sorting
Affected: fixed in 2.1.0.
Fixed in 2.1.0 (released Nov 21, 2024, 604 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58358Medium 6.9
SurrealDB before 2.1.0 Denial of Service via Nonexistent Role
Affected: fixed in 2.1.0.
Fixed in 2.1.0 (released Nov 21, 2024, 604 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58357High 7.1
SurrealDB before 2.1.0 Denial of Service via rand::time()
Affected: fixed in 2.1.0.
Fixed in 2.1.0 (released Nov 21, 2024, 604 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2024-58356Low 2.3
SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
Affected: from 2.0.0, fixed in 2.1.4.
Fixed in 2.1.4 (released Dec 18, 2024, 577 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2023-54366High 8.7
SurrealDB before 1.0.1 Insecure Default Table Permissions
Affected: fixed in 1.0.1.
Fixed in 1.0.1 (released Dec 14, 2023, 947 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-63309Medium 5.3
SurrealDB < 3.1.5 Information Disclosure via ORDER BY
Affected: from 3.0.0, fixed in 3.1.5.
Fixed in 3.1.5 (released Jun 19, 2026, 28 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2026-49997Medium 5.4
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
Affected: fixed in 3.1.0.
Fixed in 3.1.0 (released May 26, 2026, 50 days before disclosure).
The latest release, 4.0.0, is not affected.
CVE-2025-11060Medium 5.7
Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions
Affected: from 2.3.0, fixed in 2.3.8; from 2.2.0, fixed in 2.2.8; fixed in 2.1.9; from 3.0.0-alpha.0, fixed in 3.0.0-alpha.8.
Fixed in 2.1.9 (released Sep 11, 2025, 15 days before disclosure), 2.2.8 (released Sep 11, 2025, 15 days before disclosure), 2.3.8 (released Sep 11, 2025, 15 days before disclosure) and 1 other version.
The latest release, 4.0.0, is not affected.