CVE-2026-109338
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.