# surrealdb (crates.io) vulnerabilities 56 known vulnerabilities (3 critical, 26 high, 23 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.0.0 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 4.0.0 (Nov 3, 2026), the latest release - Weekly downloads: 44.7K - Dependents: 0 - Releases: 130 since 1.0.0 (Sep 13, 2023) - Registry: https://crates.io/crates/surrealdb - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - RUSTSEC-2026-0453: 1.0.0-beta.1 to 3.3.0-beta.4 (3.3.0 is outside it) - CVE-2026-63763: 1.0.0-beta.1 to 2.4.1 (2.5.0 is outside it); 3.0.0-alpha.8 to 3.0.0-beta.2 (3.0.0-beta.3 is outside it) - CVE-2026-63762: 1.0.0-beta.1 to 2.6.0 (2.6.1 is outside it); 3.0.0-alpha.8 to 3.0.0-beta.2 (3.0.0-beta.3 is outside it) - CVE-2026-63761: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63760: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63759: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63758: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63757: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63756: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63755: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63754: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63753: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63752: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63751: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63750: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63749: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63748: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63747: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63746: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63745: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63744: 1.0.0-beta.1 to 3.1.4 (3.1.5 is outside it) - CVE-2026-63743: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63742: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63741: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2026-63740: 1.0.0-beta.1 to 3.1.3 (3.1.4 is outside it) - CVE-2026-63739: 1.0.0-beta.1 to 3.1.4 (3.1.5 is outside it) - CVE-2026-63738: 3.1.0 to 3.1.4 (3.1.5 is outside it) - CVE-2026-63737: 3.0.0 to 3.1.4 (3.1.5 is outside it) - CVE-2026-63735: 1.0.0-beta.1 to 3.2.0-beta.3 (3.2.0 is outside it) - CVE-2025-71398: 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71397: 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71396: 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71395: 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71394: 1.0.0-beta.1 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71393: 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71392: 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71391: 1.0.0-beta.1 to 2.0.4 (2.0.5 is outside it); 2.1.0 to 2.1.4 (2.1.5 is outside it); 2.2.0 to 2.2.1 (2.2.2 is outside it) - CVE-2025-71390: 2.1.0 to 2.1.7 (2.1.8 is outside it); 2.2.0 to 2.2.5 (2.2.6 is outside it); 2.3.0 to 2.3.5 (2.3.6 is outside it) - CVE-2024-58370: 1.0.0-beta.1 to 1.0.2 (1.1.0 is outside it) - CVE-2024-58369: 1.0.0-beta.1 to 1.1.0 (1.1.1 is outside it) - CVE-2024-58368: 1.0.0-beta.1 to 1.0.2 (1.1.0 is outside it) - CVE-2024-58367: 1.0.0-beta.1 to 2.0.3 (2.0.4 is outside it) - CVE-2024-58366: 1.0.0-beta.1 to 1.1.0 (1.1.1 is outside it) - CVE-2024-58365: 1.0.0-beta.1 to 1.1.1 (1.2.0 is outside it) - CVE-2024-58364: 1.0.0-beta.1 to 1.2.0 (1.2.2 is outside it) - CVE-2024-58363: 1.0.0-beta.1 to 1.5.3 (1.5.4 is outside it) - CVE-2024-58362: 1.0.0-beta.1 to 1.5.4 (1.5.5 is outside it) - CVE-2024-58361: 2.0.0 to 2.0.3 (2.0.4 is outside it) - CVE-2024-58359: 1.0.0-beta.1 to 2.0.5 (2.1.0 is outside it) - CVE-2024-58358: 1.0.0-beta.1 to 2.0.5 (2.1.0 is outside it) - CVE-2024-58357: 1.0.0-beta.1 to 2.0.5 (2.1.0 is outside it) - CVE-2024-58356: 2.0.0 to 2.1.3 (2.1.4 is outside it) - CVE-2023-54366: 1.0.0-beta.1 to 1.0.0 (1.0.1 is outside it) - CVE-2026-63309: 3.0.0 to 3.1.4 (3.1.5 is outside it) - CVE-2026-49997: 1.0.0-beta.1 to 3.1.0-beta.3 (3.1.0 is outside it) - CVE-2025-11060: 1.0.0-beta.1 to 2.1.8 (2.1.9 is outside it); 2.2.0 to 2.2.7 (2.2.8 is outside it); 2.3.0 to 2.3.7 (2.3.8 is outside it) ## Advisories (56) ### [RUSTSEC-2026-0453](https://cve.now/RUSTSEC-2026-0453): Use-after-free in KV backends via leaked \`affinitypool::spawn\_local\` future - Severity: Unrated - Published: Oct 19, 2026 - Affected: fixed in 3.3.0. - Fixed in 3.3.0 (released Sep 24, 2026, 25 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63763](https://cve.now/CVE-2026-63763): SurrealDB before 2.5.0 Privilege Escalation via Future Fields - Severity: High 7.5 - Published: Jul 20, 2026 - Affected: fixed in 2.5.0; from 3.0.0-alpha.1, fixed in 3.0.0-beta.3. - Fixed in 2.5.0 (released Jan 22, 2026, 179 days before disclosure) and 3.0.0-beta.3 (released Feb 5, 2026, 165 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63762](https://cve.now/CVE-2026-63762): SurrealDB before v2.6.1 Denial of Service via scripting - Severity: Medium 6.0 - Published: Jul 20, 2026 - Affected: fixed in 2.6.1; from 3.0.0-alpha.8, fixed in 3.0.0-beta.3. - Fixed in 2.6.1 (released Feb 12, 2026, 158 days before disclosure) and 3.0.0-beta.3 (released Feb 5, 2026, 165 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63761](https://cve.now/CVE-2026-63761): SurrealDB before 3.1.0 Algorithm Downgrade via ES512 - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63760](https://cve.now/CVE-2026-63760): SurrealDB before 3.1.0 Denial of Service via JSON Parser - Severity: High 8.7 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63759](https://cve.now/CVE-2026-63759): SurrealDB before 3.1.0 Denial of Service nested type annotations - Severity: High 7.1 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63758](https://cve.now/CVE-2026-63758): SurrealDB before 3.1.0 Authorization Bypass via KILL Statement - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63757](https://cve.now/CVE-2026-63757): SurrealDB before 3.1.0 Session Hijacking via /rpc sessions - Severity: High 8.7 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63756](https://cve.now/CVE-2026-63756): SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition - Severity: Critical 9.2 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63755](https://cve.now/CVE-2026-63755): SurrealDB before 3.1.0 Permission Bypass via WHERE Clause - Severity: High 7.1 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63754](https://cve.now/CVE-2026-63754): SurrealDB before 3.1.0 Denial of Service via LIVE Query - Severity: High 7.1 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63753](https://cve.now/CVE-2026-63753): SurrealDB before 3.1.0 Authentication Bypass via LIVE Query - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63752](https://cve.now/CVE-2026-63752): SurrealDB before 3.1.0 RELATE Statement Record Overwrite - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63751](https://cve.now/CVE-2026-63751): SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63750](https://cve.now/CVE-2026-63750): SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket - Severity: Medium 6.9 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63749](https://cve.now/CVE-2026-63749): SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63748](https://cve.now/CVE-2026-63748): SurrealDB before 3.1.0 Information Disclosure via Error Messages - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63747](https://cve.now/CVE-2026-63747): SurrealDB before 3.1.0 Denial of Service via malformed RPC use - Severity: High 8.7 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63746](https://cve.now/CVE-2026-63746): SurrealDB before 3.1.0 Permission Bypass via Graph Traversal - Severity: High 7.1 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63745](https://cve.now/CVE-2026-63745): SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63744](https://cve.now/CVE-2026-63744): SurrealDB before 3.1.5 SSRF via JWKS URL Redirect - Severity: Medium 5.1 - Published: Jul 20, 2026 - Affected: fixed in 3.1.5. - Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63743](https://cve.now/CVE-2026-63743): SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63742](https://cve.now/CVE-2026-63742): SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63741](https://cve.now/CVE-2026-63741): SurrealDB before 3.1.0 Authentication Bypass via USE statement - Severity: Medium 6.9 - Published: Jul 20, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 55 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63740](https://cve.now/CVE-2026-63740): SurrealDB before 3.1.4 Array Element Permission Bypass - Severity: High 7.1 - Published: Jul 20, 2026 - Affected: fixed in 3.1.4. - Fixed in 3.1.4 (released Jun 10, 2026, 40 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63739](https://cve.now/CVE-2026-63739): SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER - Severity: High 8.3 - Published: Jul 20, 2026 - Affected: fixed in 3.1.5. - Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63738](https://cve.now/CVE-2026-63738): SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal - Severity: Medium 5.3 - Published: Jul 20, 2026 - Affected: from 3.1.0, fixed in 3.1.5. - Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63737](https://cve.now/CVE-2026-63737): SurrealDB before 3.1.5 Denial of Service via deep operator chains - Severity: High 7.1 - Published: Jul 20, 2026 - Affected: from 3.0.0, fixed in 3.1.5. - Fixed in 3.1.5 (released Jun 19, 2026, 31 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63735](https://cve.now/CVE-2026-63735): SurrealDB before 3.2.0 Authentication Bypass via Custom API - Severity: High 8.6 - Published: Jul 20, 2026 - Affected: fixed in 3.2.0. - Fixed in 3.2.0 (released Jul 2, 2026, 18 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71398](https://cve.now/CVE-2025-71398): SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass - Severity: Medium 5.8 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5. - Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71397](https://cve.now/CVE-2025-71397): SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5. - Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71396](https://cve.now/CVE-2025-71396): SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting - Severity: Low 2.3 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; fixed in 2.0.5; from 2.1.0, fixed in 2.1.5. - Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71395](https://cve.now/CVE-2025-71395): SurrealDB before 2.2.2 Memory Exhaustion via string::replace - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5. - Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71394](https://cve.now/CVE-2025-71394): SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER - Severity: Low 2.3 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; fixed in 2.1.5. - Fixed in 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71393](https://cve.now/CVE-2025-71393): SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions - Severity: Medium 6.0 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5. - Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71392](https://cve.now/CVE-2025-71392): SurrealDB before 2.2.2 SurrealQL Injection via export - Severity: Critical 9.4 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5. - Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71391](https://cve.now/CVE-2025-71391): SurrealDB before 2.2.2 Denial of Service via /sql endpoint - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: from 2.2.0, fixed in 2.2.2; from 2.1.0, fixed in 2.1.5; fixed in 2.0.5. - Fixed in 2.0.5 (released Apr 10, 2025, 464 days before disclosure), 2.1.5 (released Apr 10, 2025, 464 days before disclosure) and 2.2.2 (released Apr 10, 2025, 464 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-71390](https://cve.now/CVE-2025-71390): SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution - Severity: Medium 5.8 - Published: Jul 18, 2026 - Affected: from 2.1.0, fixed in 2.1.8; from 2.2.0, fixed in 2.2.6; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.7; from 2.3.0, fixed in 2.3.6. - Fixed in 2.1.8 (released Jun 26, 2025, 387 days before disclosure), 2.2.6 (released Jun 25, 2025, 388 days before disclosure), 2.3.6 (released Jun 25, 2025, 388 days before disclosure) and 1 other version. - The latest release, 4.0.0, is not affected. ### [CVE-2024-58370](https://cve.now/CVE-2024-58370): SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Jan 9, 2024, 921 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58369](https://cve.now/CVE-2024-58369): SurrealDB before 1.1.1 Denial of Service via Global Parameters - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: fixed in 1.1.1. - Fixed in 1.1.1 (released Jan 16, 2024, 914 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58368](https://cve.now/CVE-2024-58368): SurrealDB before 1.1.0 Denial of Service via HTTP Headers - Severity: High 8.7 - Published: Jul 18, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Jan 9, 2024, 921 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58367](https://cve.now/CVE-2024-58367): SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: fixed in 2.0.4. - Fixed in 2.0.4 (released Oct 8, 2024, 648 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58366](https://cve.now/CVE-2024-58366): SurrealDB before 1.1.1 Format String via Scripting Functions - Severity: Critical 9.0 - Published: Jul 18, 2026 - Affected: fixed in 1.1.1. - Fixed in 1.1.1 (released Jan 16, 2024, 914 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58365](https://cve.now/CVE-2024-58365): SurrealDB before 1.2.0 Denial of Service via Nonexistent Function - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: fixed in 1.2.0. - Fixed in 1.2.0 (released Feb 13, 2024, 886 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58364](https://cve.now/CVE-2024-58364): SurrealDB before 1.2.1 Denial of Service via Parsing Error - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: fixed in 1.2.1. - Fixed in 1.2.2 (released Mar 7, 2024, 863 days before disclosure, the advisory names 1.2.1, which was never published). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58363](https://cve.now/CVE-2024-58363): SurrealDB before 1.5.4 Authentication Bypass via Database Switch - Severity: Medium 5.3 - Published: Jul 18, 2026 - Affected: fixed in 1.5.4; from 2.0.0-alpha.1, fixed in 2.0.0-alpha.6. - Fixed in 1.5.4 (released Jul 10, 2024, 738 days before disclosure) and 2.0.0 (released Sep 17, 2024, 669 days before disclosure, the advisory names 2.0.0-alpha.6, which was never published). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58362](https://cve.now/CVE-2024-58362): SurrealDB before 1.5.5 Query Injection via RPC API - Severity: High 8.7 - Published: Jul 18, 2026 - Affected: fixed in 1.5.5; from 2.0.0-beta.1, fixed in 2.0.0-beta.3. - Fixed in 1.5.5 (released Sep 11, 2024, 675 days before disclosure) and 2.0.0 (released Sep 17, 2024, 669 days before disclosure, the advisory names 2.0.0-beta.3, which was never published). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58361](https://cve.now/CVE-2024-58361): SurrealDB before 2.0.4 Denial of Service via Parser Exception - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: from 2.0.0, fixed in 2.0.4. - Fixed in 2.0.4 (released Oct 8, 2024, 648 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58359](https://cve.now/CVE-2024-58359): SurrealDB before 2.1.0 Denial of Service via rand() Sorting - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: fixed in 2.1.0. - Fixed in 2.1.0 (released Nov 21, 2024, 604 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58358](https://cve.now/CVE-2024-58358): SurrealDB before 2.1.0 Denial of Service via Nonexistent Role - Severity: Medium 6.9 - Published: Jul 18, 2026 - Affected: fixed in 2.1.0. - Fixed in 2.1.0 (released Nov 21, 2024, 604 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58357](https://cve.now/CVE-2024-58357): SurrealDB before 2.1.0 Denial of Service via rand::time() - Severity: High 7.1 - Published: Jul 18, 2026 - Affected: fixed in 2.1.0. - Fixed in 2.1.0 (released Nov 21, 2024, 604 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2024-58356](https://cve.now/CVE-2024-58356): SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE - Severity: Low 2.3 - Published: Jul 18, 2026 - Affected: from 2.0.0, fixed in 2.1.4. - Fixed in 2.1.4 (released Dec 18, 2024, 577 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2023-54366](https://cve.now/CVE-2023-54366): SurrealDB before 1.0.1 Insecure Default Table Permissions - Severity: High 8.7 - Published: Jul 18, 2026 - Affected: fixed in 1.0.1. - Fixed in 1.0.1 (released Dec 14, 2023, 947 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-63309](https://cve.now/CVE-2026-63309): SurrealDB \< 3.1.5 Information Disclosure via ORDER BY - Severity: Medium 5.3 - Published: Jul 17, 2026 - Affected: from 3.0.0, fixed in 3.1.5. - Fixed in 3.1.5 (released Jun 19, 2026, 28 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2026-49997](https://cve.now/CVE-2026-49997): SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted - Severity: Medium 5.4 - Published: Jul 15, 2026 - Affected: fixed in 3.1.0. - Fixed in 3.1.0 (released May 26, 2026, 50 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2025-11060](https://cve.now/CVE-2025-11060): Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions - Severity: Medium 5.7 - Published: Sep 26, 2025 - Affected: from 2.3.0, fixed in 2.3.8; from 2.2.0, fixed in 2.2.8; fixed in 2.1.9; from 3.0.0-alpha.0, fixed in 3.0.0-alpha.8. - Fixed in 2.1.9 (released Sep 11, 2025, 15 days before disclosure), 2.2.8 (released Sep 11, 2025, 15 days before disclosure), 2.3.8 (released Sep 11, 2025, 15 days before disclosure) and 1 other version. - The latest release, 4.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/surrealdb Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.