CVE-2026-109338

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get, entries, values, or getSetCookie, or return them...

CVE-2026-109338

SurrealDB versions prior to 3.3.0 are vulnerable to a Denial of Service (DoS) flaw. The issue stems from the handling of non-ASCII header values within embedded JavaScript . Query-capable users with scripting enabled can trigger a server crash by accessing these values through functions such as H...