HIGH 7.1 NVD
CVE-2026-109338
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embe
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx
- https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-12 via NVD.
vulnfeed aggregates 10929 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.