CVE-2026-121417 SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawnlocal closures relying on future Drop for safety. Rust embedders that leak a dispatched future e.g. via mem::forget and drop the transaction...

CVE-2026-121417

SurrealDB versions prior to 3.3.0 are vulnerable to a use-after-free flaw in the surrealdb-core KV backends . The issue arises when borrowed transaction states are passed into affinitypool::spawn_local closures, relying on the Drop future for safety. If a Rust embedder leaks a dispatched future (...

Use-after-free in KV backends via leaked `affinitypool::spawn_local` future

The kv-mem, kv-surrealkv and kv-rocksdb backends move non-'static borrowed state into affinity-pool closures through affinitypool::spawnlocal: a tokio::sync::MutexGuard, &Transaction, &mut ScanStateKeys/Vals, &mut dyn KeyVisitor/ValVisitor, RwLockReadGuard, and a ReadOptions holding a raw...