CVE-2026-109339

EUVD-2026-97641
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
surrealdbsurrealdb
3.1.0 ≤
𝑥
< 3.3.0
CNA
surrealdbsurrealdb
0.3.0 ≤
𝑥
< 0.6.0
CNA
Common Weakness Enumeration
References
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jj89-wvrw-c4gp
https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-memory-exhaustion-via-surrealism-module-output-buffering