CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.0 are vulnerable due to inadequate enforcement of the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit on anonymous /sql WebSocket connections. This flaw allows attackers to send excessively large WebSocket frames, potentially leading to memory exhaustion and degradation of service availability. Organizations using affected versions should prioritize patching to mitigate the risk of denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.
Related CVEs
Other vulnerabilities affecting the same vendor(s)