Is CVE-2026-63759 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-63759?

CVE-2026-63759 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-63759

Description

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.