Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

SurrealDB prior to version 3.1.0 does not properly enforce the configured recursion depth limit in its value and JSON parser when handling nested JSON structures such as braces, brackets, or parentheses. This flaw allows unauthenticated attackers to send deeply nested JSON payloads to the WebSocket /rpc endpoint, which can exhaust server memory resources and crash the SurrealDB process, resulting in a denial of service condition. The vulnerability is tracked under CWE-674 (Improper Control of a Resource Through a Logic Time Bomb) and has a CVSS v3.1 base score of 7.5, indicating high severity. There is no indication of known exploits in the wild. No patch or remediation details are provided in the available data.

Successful exploitation leads to denial of service by exhausting server memory and crashing the SurrealDB process. This disrupts availability but does not impact confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the WebSocket /rpc endpoint to untrusted sources or implementing external rate limiting or payload size restrictions to mitigate potential abuse.