Description
SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 3.1.0 | 3.1.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | surrealdb | < 3.1.0 | 3.1.0 | GHSA-65rj-r9fh-jp2v |
References
- GitHub Security Advisory (GHSA-65rj-r9fh-jp2v) vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket third-party-advisory