6211 matches found
CVE-2026-63750
SurrealDB versions before 3.1.0 fail to apply the SURREALWEBSOCKETMAXMESSAGESIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple...
CVE-2026-63747
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...
EUVD-2026-45931
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...
CVE-2026-63760
SurrealDB prior to 3.1.0 fails to enforce recursion depth limits in its value/JSON parsers when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON to the WebSocket /rpc endpoint to exhaust server memory and crash the process. Remediation deta...
CVE-2026-63760
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...
CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...
CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...
CVE-2026-63750 SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket
SurrealDB versions before 3.1.0 fail to apply the SURREALWEBSOCKETMAXMESSAGESIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple...
CVE-2026-63750
SurrealDB before 3.1.0 is affected: the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not applied to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in per-connection read buffers. Attackers can stream large WebSocket frames across multiple concurrent connections...
CVE-2026-63750 SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket
SurrealDB versions before 3.1.0 fail to apply the SURREALWEBSOCKETMAXMESSAGESIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple...
EUVD-2026-45921
SurrealDB versions before 3.1.0 fail to apply the SURREALWEBSOCKETMAXMESSAGESIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple...
CVE-2026-63747
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...
CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...
EUVD-2026-45918
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...
CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...
CVE-2026-63747
SurrealDB prior to 3.1.0 contains a denial-of-service condition in the RPC use handler. When a request sets db without a namespace, a malformed WebSocket message sent to the /rpc endpoint can cause the server process to panic, leading to service disruption. The issue is exploitable by unauthentic...
webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...
PT-2026-61563
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description A denial of service issue exists in the RPC use handler that causes a panic when the db variable is set without a namespace. Unauthenticated attackers can crash the server process by sending a...
PT-2026-61566
SurrealDB versions before 3.1.0 fail to apply the SURREAL WEBSOCKET MAX MESSAGE SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multip...
PT-2026-61576
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description The value and JSON parser fails to enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. Unauthenticated attackers can exploit this by sending deeply...