CVE-2026-63750

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0

Description Anonymous WebSocket connections to the '/sql' endpoint do not enforce the SURREAL WEBSOCKET MAX MESSAGE SIZE limit. This allows attackers to buffer unbounded frames in the per-connection read buffer by streaming frames that exceed the configured limit across multiple concurrent connections, leading to excessive memory consumption and degradation of '/sql' availability.

Recommendations Update SurrealDB to version 3.1.0 or later.