Surrealdb-Core (< 3.3.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/surrealdb-core--3.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 15:59:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSurrealDB: Use-after-free in surrealdb-core (CVE-2026-121417)https://feed.craftedsignal.io/briefs/2026-11-surrealdb-uaf/Tue, 03 Nov 2026 15:59:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-surrealdb-uaf/SurrealDB versions prior to 3.3.0 are vulnerable to a use-after-free condition in the KV backend that can be triggered by Rust embedders that leak dispatched futures.SurrealDB versions before 3.3.0 contain a use-after-free vulnerability in the surrealdb-core KV backends. The flaw occurs when borrowed transaction state is passed into affinitypool::spawn_local closures that rely on future Drop for safety. If a Rust embedder leaks a dispatched future, such as through the use of mem::forget, the pool worker may access memory that has already been freed, leading to crashes or memory corruption.

Impact

An attacker or a malformed application can induce memory corruption or cause the SurrealDB process to crash, resulting in a potential denial-of-service or memory instability.

Recommendation

  • Upgrade SurrealDB to version 3.3.0 or later to include the fix for CVE-2026-121417.
  • Review custom Rust integrations or embedders that interact with the surrealdb-core library to ensure that futures are not improperly leaked or that the transaction lifecycle is strictly managed.
]]>highadvisory