SurrealDB versions before 3.1.0 contain a denial of service vulnerability in their JSON parser due to failure to enforce recursion depth limits when processing nested braces, brackets, or parentheses. An unauthenticated attacker can exploit this by sending deeply nested JSON payloads to the WebSocket /rpc endpoint, causing server memory exhaustion and process crashes.