CVE-2026-109338

MediumCVSS 6.5/10Last modified Oct 13, 2026

Description

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1093394.9SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host CVE-2026-109348.3Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro CVE-2026-1093405.4SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph e CVE-2026-1093417.1SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-r CVE-2026-1093425.4SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or una CVE-2026-1093438.1SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without c CVE-2026-1093446.1DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detache CVE-2026-1093456.1DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode ret CVE-2026-1093468.1better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET CVE-2026-1093477.2Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO CVE-2026-1093484.3Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time pa CVE-2026-1093496.5gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts versi