CVE-2026-63750

Description

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.

CVSS Vector

References

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-65rj-r9fh-jp2v
• https://www.vulncheck.com/advisories/surrealdb-before-memory-amplification-via-sql-websocket