CVE-2026-109339
MEDIUM
NVD
CVSS Score
4.9
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.