CVE-2026-121423

The record

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.

Affected packages

Related vulnerabilities

• CVE-2026-121092 Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-674
• CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-674
• CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via… CWE-674
• CVE-2026-120689 HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in… CWE-674
• CVE-2026-101180 DoS vulnerability in the file parsing module. CWE-674
• CVE-2026-120135 Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. CWE-674
• CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-674
• CVE-2026-61847 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-674