Surrealdb-core versions prior to 4.0.0 contain a concurrency vulnerability due to unsound implementations of Send and Sync traits in the reblessive crate. This flaw allows data races and double free conditions when futures are duplicated and polled concurrently across threads, potentially leading to memory corruption and high-impact consequences. The issue was fixed in version 4.0.0 by removing the unsound dependency and changing the parser implementation.