CVE-2026-63734 Details
Description
SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other malformed header fields that trigger unchecked unwrap calls, causing a panic that aborts the entire server process and denies service to all databases.
A denial-of-service vulnerability has been identified in SurrealDB versions prior to 3.2.0. This issue arises in the SurrealML header parser, where authenticated users with the Owner role can cause the server to crash. The vulnerability is triggered by uploading a malformed .surml file to the /ml/import endpoint. The improper input dimensions or other malformed header fields provoke unchecked unwrap calls, leading to a panic that terminates the server process, causing a service disruption for all databases on the instance.
Users can upgrade to SurrealDB version 3.2.0 or later, where this vulnerability has been patched. For those unable to upgrade, consider building or deploying without the machine learning feature, granting the Owner role sparingly, or running SurrealDB under a process supervisor that can automatically restart it after a crash.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jwr6-6444-28xv | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-malformed-surrealml-import | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.2.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |