SurrealDB versions prior to 3.1.0 contain a denial of service vulnerability in their JSON and value parser due to missing enforcement of recursion depth limits on nested JSON tokens. An unauthenticated attacker can exploit this by sending a deeply nested JSON payload to the WebSocket /rpc endpoint, causing server memory exhaustion and process crash. Versions 3.1.0 and later include a patch that enforces the recursion depth limit, mitigating this issue.