SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory,… (CVE-2026-109339)

SurrealDB versions 3.1.0 before 3.3.0 have a vulnerability (CVE-2026-109339) in which Surrealism modules buffer stdout and stderr output lines unbounded in host memory. This behavior bypasses the configured module memory limit. An attacker with Owner privileges can exploit this by running a malicious module that continuously writes output without newlines, leading to server memory exhaustion and a crash that denies service to all namespaces and databases.

The vulnerability allows an attacker with Owner-level access to cause a denial of service by crashing the SurrealDB server through memory exhaustion. This affects availability but does not impact confidentiality or integrity according to the CVSS vector. The attack requires high privileges (Owner) and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Owner-level access to trusted users only and monitor for abnormal module output behavior. Avoid running untrusted Surrealism modules that produce large or unbounded output without newlines.