CVE-2026-109339: surrealdb 3.1.0 to before 3.3.0; +1 more affected products

Affected technology

surrealdb · 3.1.0 to before 3.3.0
surrealdb

surrealism-runtime · 0.3.0 to before 0.6.0
surrealdb

Description’s affected range: before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as none; availability impact as high.