CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.2.0 are susceptible to a denial of service vulnerability in the SurrealML header parser, allowing authenticated Owner-role users to crash the server by uploading a malformed .surml file. This flaw can be exploited by providing non-numeric input dimensions or other incorrect header fields, leading to unchecked unwrap calls that result in server panic and service disruption. Organizations using SurrealDB should prioritize this issue to prevent potential service outages.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other malformed header fields that trigger unchecked unwrap calls, causing a panic that aborts the entire server process and denies service to all databases.
Related CVEs
Other vulnerabilities affecting the same vendor(s)