CVE Vulnerability Catalog

Vulnerability in SurrealDB before version 3.1.0. Authentication state is not refreshed in LIVE SELECT subscriptions after session changes. Attackers can continue receiving real-time notifications after session expiry or revocation.

SurrealDB before version 3.1.0 contains an authorization bypass vulnerability in the RELATE statement. Authenticated users with CREATE permission can overwrite existing edge records without UPDATE permission by using a SET id clause pointing to an existing edge id.

SurrealDB before version 3.1.0 contains a field-level permission bypass vulnerability in JSON Patch operations. Authenticated users can read protected fields by using UPDATE PATCH with an empty from pointer in copy or move operations, duplicating all record fields including those restricted by field-level SELECT permissions.

In SurrealDB before 3.1.0, the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not applied to anonymous /sql WebSocket connections. Attackers can stream oversized frames across multiple connections to consume excessive memory and degrade /sql availability.

SurrealDB before version 3.1.0 contains an authentication bypass vulnerability in LIVE SELECT subscriptions. Permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can register LIVE SELECT queries to receive notifications for records that should be hidden.

SurrealDB before 3.1.0 discloses field values hidden by field-level SELECT permissions through error messages. Attackers with UPDATE access can trigger arithmetic operations on hidden fields, leaking values in error responses.

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.

SurrealDB before version 3.1.0 contains an authorization bypass vulnerability allowing authenticated users to spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.

SurrealDB before version 3.1.5 contains a server-side request forgery (SSRF) vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access controls.

SurrealDB before version 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.

SurrealDB before version 3.1.0 contains a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses.

Vulnerability in SurrealDB before version 3.1.0. The system fails to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases, bypassing authorization checks.

SurrealDB before version 3.1.4 fails to properly enforce SELECT permissions on array elements (field.*) for record users. Attackers with record scope access can read array elements that should be hidden by element-level permissions.

SurrealDB versions 3.1.0 through 3.1.5 fail to enforce field-level SELECT permissions when accessed via graph-edge traversals. Attackers with table-level SELECT can read hidden fields by materializing records through graph navigation.

A vulnerability in SurrealDB before version 3.1.5 allows authenticated users to perform a denial of service (DoS) attack by submitting queries with long chains of operators. This causes a stack overflow during query processing and crashes the server.

SurrealDB before 3.2.0 has a server-side request forgery vulnerability in the JWKS fetcher. It validates only the URL hostname string against allow-lists without checking resolved IP addresses, allowing an Owner role attacker to direct requests to internal addresses.

DoS vulnerability in SurrealDB before version 3.2.0. The SurrealML header parser does not validate input, allowing authenticated Owner-role users to upload a malformed .surml file to the /ml/import endpoint. Invalid values (e.g., non-numeric input-dimensions) cause a panic that crashes the entire server.

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.

Vulnerability in claircore's apk package scanner. Malicious package database data in a container layer can cause an out-of-bounds access, leading to a scanner panic. If the panic is not recovered, the Clair indexer process can crash, causing denial of service.

Vulnerability in the network packet de-fragmentation engine of kronosnet (versions <= 1.34). The reassembly code does not properly validate sequence numbers of fragments, allowing an attacker to send malformed packets. This can lead to out-of-bounds memory access or heap corruption, causing application crashes or system instability.