Description (CNA)
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| surrealdb / surrealdb | affected 0 before 3.3.0; unaffected 3.3.0 |
CWE
CWE-248
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx
- https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-non-ascii-values
ADP enrichment
No English description supplied.
No references supplied.