crates.io/surrealdb

SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type

Modified: 9/4/2026

SurrealDB has local file read of 2-column TSV files via analyzers

Modified: 7/19/2026

SurrealDB memory exhaustion via string::replace using regex

Modified: 7/19/2026

SurrealDB no JavaScript script function default timeout could facilitate DoS

Modified: 7/19/2026

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

Modified: 7/21/2026

SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls

Modified: 7/1/2026

SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required

Modified: 7/1/2026

SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation

Modified: 7/1/2026

SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface

Modified: 1/19/2024

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

Modified: 9/4/2026

SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

Modified: 7/1/2026

Untrusted Query Object Evaluation in RPC API

Modified: 7/19/2026

SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames

Modified: 7/1/2026

SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

Modified: 9/4/2026

Uncontrolled Recursion in SurrealQL Parsing

Modified: 7/19/2026

SurrealDB has an Authorization Bypass via Composite Record-id Paths

Modified: 7/1/2026

SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions

Modified: 7/1/2026

Uncaught Exception in Macro Expecting Native Function to Exist

Modified: 7/19/2026

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

Modified: 9/4/2026

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Modified: 9/4/2026

Uncaught Exception Handling Parsing Errors on Line Terminators

Modified: 7/19/2026

SurrealDB: Improper Authorization in Select Permissions

Modified: 9/4/2026

SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

Modified: 9/4/2026

SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level

Modified: 9/4/2026

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

Modified: 7/1/2026

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

Modified: 6/19/2026

SurrealDB server-takeover via SurrealQL injection on backup import

Modified: 9/4/2026

SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission

Modified: 7/1/2026

SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

Modified: 9/4/2026

SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

Modified: 9/4/2026

SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

Modified: 9/4/2026

SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User

Modified: 7/19/2026

SurrealDB has an Uncaught Exception in Function Generating Random Time

Modified: 7/19/2026

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

Modified: 6/19/2026

SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch

Modified: 6/19/2026

SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

Modified: 9/4/2026

SurrealDB has an Uncaught Exception Handling Nonexistent Role

Modified: 9/4/2026

Uncaught Exception in surrealdb

Modified: 7/19/2026

SurrealDB: Denial of Service via deep operator chains

Modified: 6/19/2026

Uncaught Exception processing HTTP Headers in SurrealDB

Modified: 9/4/2026

SurrealDB has an Uncaught Exception Sorting Tables by Random Order

Modified: 7/19/2026

SurrealDB vulnerable to memory exhaustion via nested functions and scripts

Modified: 7/19/2026

SurrealDB CPU exhaustion via custom functions result in total DoS

Modified: 7/19/2026

Externally Controlled Format String in Scripting Functions

Modified: 7/19/2026

SurrealDB has Denial of Service in JSON parser due to nested objects

Modified: 9/4/2026

SurrealDB vulnerable to Denial of Service due to nested types annotations

Modified: 7/1/2026

SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings

Modified: 7/19/2026

SurrealDB has uncaught exception in Net module that leads to database crash

Modified: 7/19/2026

SurrealDB: Graph traversal bypasses table SELECT permissions

Modified: 9/4/2026

SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

Modified: 7/20/2026

SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

Modified: 7/1/2026

SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

Modified: 7/1/2026

SurrealDB: Full Table Permissions by Default

Modified: 9/4/2026

SurrealDB vulnerable to Denial of Service through scripting function memory edge case

Modified: 7/21/2026