CVE-2026-109338
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users…
- Risk score
- 44/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() e…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.3.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.
Last activity 12 Oct 2026. Patch Forecast updates every hour.