Description
SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 3.3.0 | 3.3.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | surrealdb | >= 0.0.0-0, < 3.3.0 | 3.3.0 | RUSTSEC-2026-0453 |
References
- GitHub Security Advisory (GHSA-pm86-cc75-q463) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends third-party-advisory