Is surrealdb safe to use? Its security history

Every advisory, newest first

• VulnerabilityGHSA-848m-r628-vrxw · 2026-09-04SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
• VulnerabilityGHSA-8rw6-p7m8-63jp · 2026-08-14SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
• VulnerabilityGHSA-whwg-vh4f-pmmf · 2026-07-01SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
• VulnerabilityGHSA-fwg2-gr34-q3w8 · 2026-07-01SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
• VulnerabilityGHSA-c8jx-96c9-8xrp · 2026-07-01SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
• VulnerabilityGHSA-wp87-mgvq-5j93 · 2026-07-01SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
• VulnerabilityGHSA-97vg-427p-8hx5 · 2026-07-01SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
• VulnerabilityGHSA-6wqw-vhfr-9999 · 2026-07-01SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
• VulnerabilityGHSA-f82j-v89j-mf86 · 2026-07-01SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
• VulnerabilityGHSA-fpxg-5xmv-922m · 2026-07-01SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
• VulnerabilityGHSA-6g9v-7gq3-p2c6 · 2026-07-01SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
• VulnerabilityGHSA-4m82-p8cx-f94j · 2026-07-01SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls
• VulnerabilityGHSA-65rj-r9fh-jp2v · 2026-07-01SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames
• VulnerabilityGHSA-gcwr-5mrf-fvch · 2026-07-01SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
• VulnerabilityGHSA-4v76-cw68-4vc9 · 2026-07-01SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
• VulnerabilityGHSA-6vg3-hgrw-p5gf · 2026-07-01SurrealDB has an Authorization Bypass via Composite Record-id Paths
• VulnerabilityGHSA-vjjx-rfw4-rmfc · 2026-07-01SurrealDB: Graph traversal bypasses table SELECT permissions
• VulnerabilityGHSA-98fx-66cf-fc7c · 2026-07-01SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level
• VulnerabilityGHSA-q8qp-67f9-wr3f · 2026-07-01SurrealDB vulnerable to Denial of Service due to nested types annotations
• VulnerabilityGHSA-wjjj-24cx-f28g · 2026-07-01SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
• VulnerabilityGHSA-q729-696q-g9pq · 2026-07-01SurrealDB has Denial of Service in JSON parser due to nested objects
• VulnerabilityGHSA-4vgr-h27g-cf9p · 2026-07-01SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
• VulnerabilityGHSA-5qfp-32cf-69jh · 2026-07-01SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
• VulnerabilityGHSA-jv2j-mqmw-xvv5 · 2026-06-19SurrealDB: Denial of Service via deep operator chains
• VulnerabilityGHSA-hv6h-hc26-q48p · 2026-06-19SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
• VulnerabilityGHSA-h4h3-3rfj-x6fq · 2026-06-19SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
• VulnerabilityGHSA-cc8f-fcx3-gpjr · 2026-06-19SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
• VulnerabilityGHSA-h5rg-8p7f-47g2 · 2026-06-19SurrealDB: SSRF via JWKS URL , Redirect Following in JWT Key Fetch
• VulnerabilityGHSA-xx7m-69ff-9crp · 2026-02-12SurrealDB vulnerable to Denial of Service through scripting function memory edge case
• VulnerabilityGHSA-xx7m-69ff-9crp · 2026-02-12SurrealDB vulnerable to Denial of Service through scripting function memory edge case
• VulnerabilityGHSA-3v2x-9xcv-2v2v · 2026-01-22SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions
• VulnerabilityGHSA-3v2x-9xcv-2v2v · 2026-01-22SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions
• VulnerabilityGHSA-5q9x-554g-9jgg · 2025-04-11SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)
• VulnerabilityGHSA-5q9x-554g-9jgg · 2025-04-11SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)
• VulnerabilityGHSA-5q9x-554g-9jgg · 2025-04-11SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)
• VulnerabilityGHSA-pxw4-94j3-v9pf · 2025-04-11SurrealDB CPU exhaustion via custom functions result in total DoS
• VulnerabilityGHSA-pxw4-94j3-v9pf · 2025-04-11SurrealDB CPU exhaustion via custom functions result in total DoS
• VulnerabilityGHSA-pxw4-94j3-v9pf · 2025-04-11SurrealDB CPU exhaustion via custom functions result in total DoS
• VulnerabilityGHSA-3824-qmfq-2qv7 · 2025-04-11SurrealDB no JavaScript script function default timeout could facilitate DoS
• VulnerabilityGHSA-3824-qmfq-2qv7 · 2025-04-11SurrealDB no JavaScript script function default timeout could facilitate DoS
• VulnerabilityGHSA-3824-qmfq-2qv7 · 2025-04-11SurrealDB no JavaScript script function default timeout could facilitate DoS
• VulnerabilityGHSA-3633-g6mg-p6qq · 2025-04-11SurrealDB memory exhaustion via string::replace using regex
• VulnerabilityGHSA-3633-g6mg-p6qq · 2025-04-11SurrealDB memory exhaustion via string::replace using regex
• VulnerabilityGHSA-3633-g6mg-p6qq · 2025-04-11SurrealDB memory exhaustion via string::replace using regex
• VulnerabilityGHSA-ccj3-5p93-8p42 · 2025-04-11SurrealDB server-takeover via SurrealQL injection on backup import
• VulnerabilityGHSA-ccj3-5p93-8p42 · 2025-04-11SurrealDB server-takeover via SurrealQL injection on backup import
• VulnerabilityGHSA-ccj3-5p93-8p42 · 2025-04-11SurrealDB server-takeover via SurrealQL injection on backup import
• VulnerabilityGHSA-2cvj-g5r5-jrrg · 2025-04-10SurrealDB has local file read of 2-column TSV files via analyzers
• VulnerabilityGHSA-2cvj-g5r5-jrrg · 2025-04-10SurrealDB has local file read of 2-column TSV files via analyzers
• VulnerabilityGHSA-m7rc-8w7m-r9qr · 2025-04-10SurrealDB vulnerable to memory exhaustion via nested functions and scripts
• VulnerabilityGHSA-m7rc-8w7m-r9qr · 2025-04-10SurrealDB vulnerable to memory exhaustion via nested functions and scripts
• VulnerabilityGHSA-m7rc-8w7m-r9qr · 2025-04-10SurrealDB vulnerable to memory exhaustion via nested functions and scripts
• VulnerabilityGHSA-rq86-9m6r-cm3g · 2025-04-10SurrealDB has uncaught exception in Net module that leads to database crash
• VulnerabilityGHSA-rq86-9m6r-cm3g · 2025-04-10SurrealDB has uncaught exception in Net module that leads to database crash
• VulnerabilityGHSA-rq86-9m6r-cm3g · 2025-04-10SurrealDB has uncaught exception in Net module that leads to database crash
• VulnerabilityGHSA-27vq-hv74-7cqp · 2024-12-16SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type
• VulnerabilityGHSA-m52v-24p8-654f · 2024-11-22SurrealDB has an Uncaught Exception Sorting Tables by Random Order
• VulnerabilityGHSA-jc55-246c-r88f · 2024-11-22SurrealDB has an Uncaught Exception Handling Nonexistent Role
• VulnerabilityGHSA-h4f5-h82v-5w4r · 2024-11-22SurrealDB has an Uncaught Exception in Function Generating Random Time
• VulnerabilityGHSA-9722-9j67-vjcr · 2024-10-08SurrealDB: Improper Authorization in Select Permissions
• VulnerabilityGHSA-qjrv-v6qp-x99x · 2024-10-08SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings
• VulnerabilityGHSA-64f8-pjgr-9wmr · 2024-09-11Untrusted Query Object Evaluation in RPC API
• VulnerabilityGHSA-64f8-pjgr-9wmr · 2024-09-11Untrusted Query Object Evaluation in RPC API
• VulnerabilityGHSA-gh9f-6xm2-c4j2 · 2024-07-11SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
• VulnerabilityGHSA-gh9f-6xm2-c4j2 · 2024-07-11SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User
• VulnerabilityGHSA-q3gg-m8hr-h4x4 · 2024-02-21Externally Controlled Format String in Scripting Functions
• VulnerabilityGHSA-6wr5-jmpr-mjcx · 2024-02-21Uncaught Exception in Macro Expecting Native Function to Exist
• VulnerabilityGHSA-8xff-473h-f863 · 2024-02-21Uncaught Exception Handling Parsing Errors on Line Terminators
• VulnerabilityGHSA-58j9-j2fj-v8f4 · 2024-01-19SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
• VulnerabilityGHSA-6r8p-hpg7-825g · 2024-01-18Uncontrolled Recursion in SurrealQL Parsing
• VulnerabilityGHSA-m24x-r6q3-2vp9 · 2024-01-18Uncaught Exception processing HTTP Headers in SurrealDB
• VulnerabilityGHSA-jm4v-58r5-66hj · 2024-01-18Uncaught Exception in surrealdb
• VulnerabilityGHSA-x5fr-7hhj-34j3 · 2023-12-15SurrealDB: Full Table Permissions by Default

Check your version

Run cargo tree -i surrealdb to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.