Duplicate Advisory: SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-97vg-427p-8hx5. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated...

CVE-2026-63743

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed...