SurrealDB Parser Recursion Limit Bypass Causes Denial of Service

SurrealDB versions before 3.1.0 contain a critical flaw in their JSON and value parsers that fail to properly enforce configured recursion depth limits. When processing deeply nested structures—braces, brackets, or parentheses—the parser does not terminate at the intended depth threshold, allowing attackers to craft malicious payloads that consume excessive memory. An unauthenticated attacker can exploit the publicly accessible WebSocket /rpc endpoint to send these nested payloads, causing the SurrealDB process to exhaust available memory and crash. This vulnerability affects any organization running vulnerable SurrealDB instances exposed to untrusted networks, particularly those using SurrealDB as a backend for applications requiring high availability.

While this CVE does not map directly to specific MITRE ATT&CK techniques, Casky's security skills—powered by Claude's extended reasoning—would detect the attack patterns underlying CWE-674 (Uncontrolled Recursion) by analyzing resource consumption anomalies and parser behavior. A practitioner using Casky would observe findings indicating sudden memory spikes correlated with WebSocket /rpc requests containing progressively nested JSON structures, coupled with detection of parser error logs and service crashes. The platform's 754 skills would flag the characteristic signature of denial-of-service attacks (Resource Exhaustion) by correlating payload structure analysis with system performance degradation, enabling defenders to identify exploitation attempts and implement protective measures like request depth validation, rate limiting on the /rpc endpoint, or immediate patching to version 3.1.0 or later.