SurrealDB: Use-after-free in surrealdb-core (CVE-2026-121417)
SurrealDB versions prior to 3.3.0 are vulnerable to a use-after-free condition in the KV backend that can be triggered by Rust embedders that leak dispatched futures.
CVE search metadata
CVE search record: CVE-2026-121417. Severity: high. CVSS: 7.8. KEV: no. Product: surrealdb-core (< 3.3.0). Brief: SurrealDB: Use-after-free in surrealdb-core (CVE-2026-121417). Brief link: https://feed.craftedsignal.io/briefs/2026-11-surrealdb-uaf/
Triage facts
Revision 1- Applicability
- surrealdb-core (< 3.3.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 15:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
SurrealDB versions before 3.3.0 contain a use-after-free vulnerability in the surrealdb-core KV backends. The flaw occurs when borrowed transaction state is passed into affinitypool::spawn_local closures that rely on future Drop for safety. If a Rust embedder leaks a dispatched future, such as through the use of mem::forget, the pool worker may access memory that has already been freed, leading to crashes or memory corruption.
Impact
An attacker or a malformed application can induce memory corruption or cause the SurrealDB process to crash, resulting in a potential denial-of-service or memory instability.
Recommendation
- Upgrade SurrealDB to version 3.3.0 or later to include the fix for CVE-2026-121417.
- Review custom Rust integrations or embedders that interact with the surrealdb-core library to ensure that futures are not improperly leaked or that the transaction lifecycle is strictly managed.
Threat Hunt
Monitor for unexpected process terminations or segmentation faults in the SurrealDB service
Data: Application logs, System crash logs, SIGSEGV or SIGABRT signals in process monitoring
Mitigations
Upgrade SurrealDB to version 3.3.0 or later
CVE-2026-121417