CVE-2026-63750 Details

A memory amplification vulnerability has been identified in SurrealDB versions prior to 3.1.0. The issue arises because the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not applied to anonymous /sql WebSocket connections. This oversight allows attackers to send unbounded WebSocket frames that accumulate in the per-connection read buffer. By streaming frames larger than the configured limit across multiple concurrent connections, attackers can consume excessive memory, potentially leading to an out-of-memory condition and degraded availability of the /sql service.

Users can update to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For those unable to update, it is recommended to refuse WebSocket upgrade requests to the /sql endpoint at a reverse proxy, or to apply per-connection frame size limits at the reverse proxy.