GHSA-q729-696q-g9pq: SurrealDB has Denial of Service in JSON parser due to nested objects
(updated )
The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when parsing nested {, [, or ( tokens. The expression parser already enforced the limit for these tokens; the value/JSON parser omitted it. An unauthenticated attacker could send a deeply nested JSON payload to the WebSocket /rpc endpoint and exhaust server memory, crashing the process.
References
- github.com/advisories/GHSA-q729-696q-g9pq
- github.com/surrealdb/surrealdb/commit/1bd9826f477f4089134460dc5574b6f4e6916973
- github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq
- nvd.nist.gov/vuln/detail/CVE-2026-63760
- www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser
Code Behaviors & Features
Detect and mitigate GHSA-q729-696q-g9pq with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →