CVE-2026-121417

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawnlocal closures relying on future Drop for safety. Rust embedders that leak a dispatched future e.g. via mem::forget and drop the transaction...

EUVD-2026-115949

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawnlocal closures relying on future Drop for safety. Rust embedders that leak a dispatched future e.g. via mem::forget and drop the transaction...

CVE-2026-121417 SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawnlocal closures relying on future Drop for safety. Rust embedders that leak a dispatched future e.g. via mem::forget and drop the transaction...

CVE-2026-121417: surrealdb: SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed…

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawnlocal closures relying on future Drop for safety. Rust embedders that leak a dispatched future e.g. via mem::forget and drop the transaction...