CVE-2026-121417

SurrealDB versions prior to 3.3.0 are vulnerable to a use-after-free flaw in the surrealdb-core KV backends . The issue arises when borrowed transaction states are passed into affinitypool::spawn_local closures, relying on the Drop future for safety. If a Rust embedder leaks a dispatched future (...