Is CVE-2026-63750 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-63750?

CVE-2026-63750 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-63750

Description

SurrealDB versions before 3.1.0 fail to apply the SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multiple concurrent connections to consume excessive memory and degrade /sql availability.