NULL pointer dereference in Surrealdb

CVE-2026-63762

SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execut…

Affected products

  • Surrealdb — versions 0, 2.6.1, 3.0.0-beta.3

Weakness classification (CWE)

References