{"id":"CVE-2026-109338","state":"PUBLISHED","title":"SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values","description":"SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.","publishedAt":"2026-10-12T16:05:25.106Z","updatedAt":"2026-10-13T16:11:45.843Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["surrealdb surrealdb"],"affected":[{"vendor":"surrealdb","product":"surrealdb","packageURL":"pkg:cargo/surrealdb","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.3.0","versionType":"semver"},{"version":"3.3.0","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx","https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-non-ascii-values"],"weaknesses":["CWE-248"],"ingestedAt":"2026-10-29T20:10:33.477Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/109xxx/CVE-2026-109338.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-109338","state":"PUBLISHED","datePublished":"2026-10-12T16:05:25.106Z","dateUpdated":"2026-10-13T16:11:45.843Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-12T14:19:01.652Z"},"containers":{"cna":{"title":"SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values","descriptions":[{"lang":"en","value":"SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process."}],"affected":[{"vendor":"surrealdb","product":"surrealdb","packageURL":"pkg:cargo/surrealdb","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.3.0","versionType":"semver"},{"version":"3.3.0","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-84w9-87hm-mxqx)"},{"url":"https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-non-ascii-values","name":"VulnCheck Advisory: SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-248","lang":"en","description":"Uncaught Exception","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-12T16:05:25.106Z"},"datePublic":"2026-09-28T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*","versionEndExcluding":"3.3.0"}]}]}],"credits":[{"lang":"en","value":"gigioneggiando","type":"reporter"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-13T16:10:50.892434Z","id":"CVE-2026-109338","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-13T16:11:45.843Z"}}]}}}