A single unauthenticated WebSocket message to /rpc crashed the SurrealDB server. Sending use { db: "x" } without first selecting a namespace hit .expect("namespace should be set") in the use handler; because surrealdb-core is built with panic = 'abort', the panic terminated the process. use is callable before signin, and the per-method capability check passes by default for guest callers — so no credentials, token, or --allow-guests flag are required.
Impact
An unauthenticated remote attacker who could reach the /rpc endpoint could crash the SurrealDB server with a single WebSocket message. No credentials, token, session knowledge, or capability are required.
Patches
A patch has been introduced that returns a typed invalid_params response when db is set on a session with no ns, replacing the panic.
- Versions 3.1.0 and later are not affected by this issue.
Workarounds
Affected users who are unable to update should restrict network access to the /rpc endpoint to trusted clients, and run SurrealDB under a process supervisor that restarts on crash.
References
A single unauthenticated WebSocket message to
/rpccrashed the SurrealDB server. Sendinguse { db: "x" }without first selecting a namespace hit.expect("namespace should be set")in theusehandler; becausesurrealdb-coreis built withpanic = 'abort', the panic terminated the process.useis callable beforesignin, and the per-method capability check passes by default for guest callers — so no credentials, token, or--allow-guestsflag are required.Impact
An unauthenticated remote attacker who could reach the
/rpcendpoint could crash the SurrealDB server with a single WebSocket message. No credentials, token, session knowledge, or capability are required.Patches
A patch has been introduced that returns a typed
invalid_paramsresponse whendbis set on a session with nons, replacing the panic.Workarounds
Affected users who are unable to update should restrict network access to the
/rpcendpoint to trusted clients, and run SurrealDB under a process supervisor that restarts on crash.References