Unbounded Recursion Vulnerability in SurrealDB Product by SurrealDB

CVE-2026-121423

What is CVE-2026-121423?

SurrealDB versions prior to 3.3.0 are vulnerable to an unbounded recursion issue. This flaw allows authenticated users to exploit the system by recursively triggering stack overflows with deeply nested values. Attackers can execute UPDATE statements that wrap a stored array around itself and subsequently perform SELECT or EXPORT operations, resulting in persistent denial of service across all tenants of the database. This issue poses significant risks to application availability and requires urgent remediation.

References