SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

Summary

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.

Remediation

1. Inventory every surrealdb surrealdb deployment, including staging.
2. Upgrade surrealdb surrealdb to 3.3.0.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a
• Advisoryhttps://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463
• Advisoryhttps://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends