CVE-2026-121423
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.