SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization

Summary

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.

Remediation

1. Inventory every surrealdb surrealdb deployment, including staging.
2. Upgrade surrealdb surrealdb to 3.3.0.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg
• Advisoryhttps://www.vulncheck.com/advisories/surrealdb-before-3.3.0-dos-via-unbounded-recursion-in-val-value-serialization