GHSA-q8qp-67f9-wr3f: SurrealDB vulnerable to Denial of Service due to nested types annotations
The SurrealDB type/kind parser did not enforce the configured recursion depth limit when parsing nested type annotations. The expression parser already enforced the limit for analogous constructs; the kind parser omitted it. An authenticated attacker could send a query with deeply nested type annotations (e.g., array<option<array<option<...>>>>) and exhaust server memory, crashing the process.
References
Code Behaviors & Features
Detect and mitigate GHSA-q8qp-67f9-wr3f with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →