CVE-2026-63750

SurrealDB before 3.1.0 is affected: the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not applied to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in per-connection read buffers. Attackers can stream large WebSocket frames across multiple concurrent connections...