What is CVE-2026-63760?

CVE-2026-63760 is a high-severity vulnerability in Surrealdb, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2026-07-20.

How severe is CVE-2026-63760?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Surrealdb

CVE-2026-63760

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSoc…

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Surrealdb — versions 0, 3.1.0

Weakness classification (CWE)

CWE-674 — Uncontrolled Recursion

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-63760?: CVE-2026-63760 is a high-severity vulnerability in Surrealdb, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2026-07-20.
How severe is CVE-2026-63760?: High severity. CVSS v3 base score is 7.5 out of 10.