Is CVE-2026-121423 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121423?

CVE-2026-121423 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-121423

Description

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.