Security
فارسی
All products

surrealdb

Rust / Cargo · Package
55 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Use-after-free in KV backends via leaked `affinitypool::spawn_local` futureCVE-2026-121417 · GHSA-PM86-CC75-Q463 surrealdb Rust / Cargo High Fix reported
SurrealDB has Denial of Service in JSON parser due to nested objectsCVE-2026-63760 · GHSA-Q729-696Q-G9PQ surrealdb Rust / Cargo High Fix reported
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitationCVE-2026-63761 · GHSA-FWG2-GR34-Q3W8 surrealdb Rust / Cargo Medium Fix reported
SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth levelCVE-2026-63755 · GHSA-98FX-66CF-FC7C surrealdb Rust / Cargo Medium Fix reported
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live QueriesCVE-2026-63758 · GHSA-GCWR-5MRF-FVCH surrealdb Rust / Cargo Medium Fix reported
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirectCVE-2026-63743 · GHSA-97VG-427P-8HX5 surrealdb Rust / Cargo Medium Fix reported
SurrealDB: Graph traversal bypasses table SELECT permissionsCVE-2026-63746 · GHSA-VJJX-RFW4-RMFC surrealdb Rust / Cargo Medium Fix reported
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`CVE-2026-63751 · GHSA-FPXG-5XMV-922M surrealdb Rust / Cargo Medium Fix reported
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messagesCVE-2026-63748 · GHSA-6G9V-7GQ3-P2C6 surrealdb Rust / Cargo Medium Fix reported
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL pathCVE-2026-63735 · GHSA-848M-R628-VRXW surrealdb Rust / Cargo High Fix reported
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversalsCVE-2026-63738 · GHSA-HV6H-HC26-Q48P surrealdb Rust / Cargo Medium Fix reported
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record usersCVE-2026-63740 · GHSA-8RW6-P7M8-63JP surrealdb Rust / Cargo Medium Fix reported
Uncaught Exception processing HTTP Headers in SurrealDBCVE-2024-58368 · GHSA-M24X-R6Q3-2VP9 surrealdb Rust / Cargo High Fix reported
SurrealDB: Improper Authorization in Select PermissionsCVE-2024-58367 · GHSA-9722-9J67-VJCR surrealdb-coresurrealdb Rust / Cargo High Fix reported
SurrealDB server-takeover via SurrealQL injection on backup importCVE-2025-71392 · GHSA-CCJ3-5P93-8P42 surrealdb Rust / Cargo Critical Fix reported
SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)CVE-2025-71398 · GHSA-5Q9X-554G-9JGG surrealdb Rust / Cargo Medium Fix reported
SurrealDB has an Uncaught Exception Handling Nonexistent RoleCVE-2024-58358 · GHSA-JC55-246C-R88F surrealdb-coresurrealdb Rust / Cargo Medium Fix reported
SurrealDB has Silent Failure to Overwrite Table Definition of Relation TypeCVE-2024-58356 · GHSA-27VQ-HV74-7CQP surrealdb-coresurrealdb Rust / Cargo Low Fix reported
SurrealDB: Full Table Permissions by DefaultCVE-2023-54366 · GHSA-X5FR-7HHJ-34J3 surrealdbsurrealdb Rust / CargoPyPI High Fix reported
SurrealDB vulnerable to Denial of Service through scripting function memory edge caseCVE-2026-63762 · GHSA-XX7M-69FF-9CRP surrealdb Rust / Cargo Medium Fix reported