{"items":[{"id":"NVI-00018332","kind":"vulnerability","title":"SurrealDB: Denial of Service via deep operator chains","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jv2j-mqmw-xvv5"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1253ac6c50f8c943be29a043ee20ef33"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-19T22:10:56.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1253ac6c50f8c943be29a043ee20ef33"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1253ac6c50f8c943be29a043ee20ef33","url":"https://github.com/advisories/GHSA-jv2j-mqmw-xvv5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jv2j-mqmw-xvv5","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T07:18:46.322Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1253ac6c50f8c943be29a043ee20ef33"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"An authenticated user could crash a SurrealDB server with a single query containing a long chain of operators.\n\nSuch a query — for example `RETURN 1 + 1 + 1 + ...` with tens of thousands of terms — is parsed into an expression tree one level deep per operator. Because the chain is flat and the pratt parser appends to it iteratively, the configured query- and object-recursion limits never fire, so the tree grows unbounded with the length of the query.\n\nThe root cause: the over-deep tree is later walked recursively, one call per node, when it is dropped, formatted, or lowered for execution — overflowing the thread stack and aborting the process.\n\n### Impact\n\nAn authenticated user with query-execution privileges can crash a SurrealDB server with a single query containing a long chain of operators. The whole process aborts, denying service to every namespace and database on that instance until it is restarted. The crash occurs during query processing, before any data is read or written (availability only).\n\n### Patches\n\nA patch introduces a dedicated expression-depth budget — `expr_recursion_limit`, sourced from `max_expression_parsing_depth` (default 128, configurable via `SURREAL_MAX","public_affected_ranges":[">= 3.0.0, < 3.1.5"]}],"null_published_at":"2026-11-07T07:07:39.815Z","source_updated_at":"2026-06-19T22:10:56.000Z","source_disclosed_at":"2026-06-19T22:10:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T07:18:46.322Z"}],"next_cursor":null,"snapshot_revision":"42594"}