crates.io (Rust)

surrealdb Known Vulnerabilities & Fixes

surrealdb has 29 known security vulnerabilities in crates.io (Rust). Upgrade to version 3.2.0 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

29 Vulnerabilities

Low Immediate Risk

No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.

Recommended safe version: 3.2.0

Upgrading to 3.2.0 or later resolves all 29 known vulnerabilities in surrealdb. Update Cargo.toml: surrealdb = "3.2.0"

Is surrealdb in your project?

Check if you're affected and upgrade to 3.2.0 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Security Summary

51 affected version ranges have been identified across these 29 advisories.
100% of known issues have a published fixed version.
Remediation: cargo update -p surrealdb

Vulnerabilities

29 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Dec 15, 2023, most recently Sep 4, 2026 (995 days apart).

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2025-71392 SurrealDB server-takeover via SurrealQL injection on backup import	CRITICAL	9.0	—	SurrealDB server-takeover via SurrealQL injection on backup import	All versions	2.2.2, 2.1.5, 2.0.5
CVE-2024-58367 SurrealDB: Improper Authorization in Select Permissions	HIGH	6.5	—	SurrealDB: Improper Authorization in Select Permissions	All versions	2.0.4
CVE-2024-58361 SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings	HIGH	6.5	—	SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings	All versions	2.0.4
CVE-2024-58362 Untrusted Query Object Evaluation in RPC API	HIGH	8.8	—	Untrusted Query Object Evaluation in RPC API	All versions	1.5.5, 2.0.0-beta.3
CVE-2026-63735 SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path	HIGH	8.1	—	SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path	All versions	3.2.0
CVE-2023-54366 SurrealDB: Full Table Permissions by Default	HIGH	8.8	—	SurrealDB: Full Table Permissions by Default	All versions	1.0.1
CVE-2026-63763 SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions	HIGH	7.7	—	SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions	All versions	2.5.0, 3.0.0-beta.3
CVE-2024-58366 Externally Controlled Format String in Scripting Functions	HIGH	8.5	—	Externally Controlled Format String in Scripting Functions	All versions	1.1.1
CVE-2026-63760 SurrealDB has Denial of Service in JSON parser due to nested objects	HIGH	7.5	—	SurrealDB has Denial of Service in JSON parser due to nested objects	All versions	3.1.0
CVE-2024-58368 Uncaught Exception processing HTTP Headers in SurrealDB	HIGH	7.5	—	Uncaught Exception processing HTTP Headers in SurrealDB	All versions	1.1.0
CVE-2025-71397 SurrealDB CPU exhaustion via custom functions result in total DoS	HIGH	6.5	—	SurrealDB CPU exhaustion via custom functions result in total DoS	All versions	2.2.2, 2.1.5, 2.0.5
CVE-2025-71395 SurrealDB memory exhaustion via string::replace using regex	HIGH	6.5	—	SurrealDB memory exhaustion via string::replace using regex	All versions	2.2.2, 2.1.5, 2.0.5
CVE-2025-71391 SurrealDB has uncaught exception in Net module that leads to database crash	HIGH	6.5	—	SurrealDB has uncaught exception in Net module that leads to database crash	All versions	2.2.2, 2.1.5, 2.0.5
GHSA-5qfp-32cf-69jh SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers	HIGH	8.8	—	SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers	All versions	3.1.0
GHSA-4vgr-h27g-cf9p SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation	HIGH	8.1	—	SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation	All versions	3.1.0
CVE-2024-58365 Uncaught Exception in Macro Expecting Native Function to Exist	MEDIUM	6.5	—	Uncaught Exception in Macro Expecting Native Function to Exist	All versions	1.2.0
CVE-2024-58364 Uncaught Exception Handling Parsing Errors on Line Terminators	MEDIUM	6.5	—	Uncaught Exception Handling Parsing Errors on Line Terminators	All versions	1.2.1
CVE-2026-63762 SurrealDB vulnerable to Denial of Service through scripting function memory edge case	MEDIUM	6.1	—	SurrealDB vulnerable to Denial of Service through scripting function memory edge case	All versions	2.6.1, 3.0.0-beta.3
CVE-2024-58359 SurrealDB has an Uncaught Exception Sorting Tables by Random Order	MEDIUM	6.5	—	SurrealDB has an Uncaught Exception Sorting Tables by Random Order	All versions	2.1.0
CVE-2024-58357 SurrealDB has an Uncaught Exception in Function Generating Random Time	MEDIUM	6.5	—	SurrealDB has an Uncaught Exception in Function Generating Random Time	All versions	2.1.0
CVE-2025-71393 SurrealDB vulnerable to memory exhaustion via nested functions and scripts	MEDIUM	6.1	—	SurrealDB vulnerable to memory exhaustion via nested functions and scripts	All versions	2.2.2, 2.1.5, 2.0.5
CVE-2025-11060 SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions	MEDIUM	5.7	—	SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions	All versions	2.3.8, 2.2.8, 2.1.9 (+1 more)
CVE-2024-58363 SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User	MEDIUM	6.3	—	SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User	All versions	1.5.4, 2.0.0-alpha.6
CVE-2025-71390 SurrealDB allows bypass of deny-net flags via DNS resolution	MEDIUM	9.5	—	SurrealDB allows bypass of deny-net flags via DNS resolution	All versions	2.1.8, 2.2.6, 3.0.0-alpha.7 (+1 more)
CVE-2025-71398 SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)	MEDIUM	9.5	—	SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)	All versions	2.2.2, 2.1.5, 2.0.5
CVE-2026-63740 SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users	MEDIUM	6.5	—	SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users	All versions	3.1.4
CVE-2026-63746 SurrealDB: Graph traversal bypasses table SELECT permissions	MEDIUM	6.5	—	SurrealDB: Graph traversal bypasses table SELECT permissions	All versions	3.1.0
CVE-2026-63755 SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level	MEDIUM	6.5	—	SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level	All versions	3.1.0
CVE-2026-63743 SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect	MEDIUM	6.4	—	SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect	All versions	3.1.0

About This Data

Vulnerability data for surrealdb is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Related crates.io (Rust) Packages

Other packages in this ecosystem, ranked by shared vulnerabilities where available.

surrealdb-core

6 shared

wasmtime Deno zebrad openssl-src deepseek-tui apollo-router russh

Check Your Dependencies

Scan your project to check if you're using a vulnerable version of surrealdb.

Start Free Scan Create Free Account

Data from OSV DatabaseUpdated daily200K+ vulnerabilities indexed