{"id":"EUVD-2026-115949","enisaUuid":"47e23b56-e4aa-3083-8455-114e4af58078","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","datePublished":"Nov 3, 2026, 2:28:15 PM","dateUpdated":"Nov 3, 2026, 5:06:36 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463\nhttps://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a\nhttps://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends\n","aliases":"CVE-2026-121417\nGHSA-7wmw-j7vc-669r\n","assigner":"VulnCheck","epss":0.2,"enisaIdProduct":[{"id":"097df8de-b45d-3209-b91c-4e758a9fe028","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c3.3.0"}],"enisaIdVendor":[{"id":"b42cf2af-f7b1-3708-8d2a-2166ef60dd22","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"27dc19b5-38b4-3f60-971d-112c89ec6e50","vulnerability":{"id":"CVE-2026-121417","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","datePublished":"Nov 3, 2026, 2:28:15 PM","dateUpdated":"Nov 3, 2026, 5:06:36 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463\nhttps://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a\nhttps://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends\n","enisa_id":"EUVD-2026-115949\n","assigner":"VulnCheck","epss":0.2,"dataProcessed":"Nov 8, 2026, 7:13:09 AM","vulnerabilityProduct":[{"id":"a645b7f8-a5c1-3c3d-8e76-a06f23c742e0","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c3.3.0"}],"vulnerabilityVendor":[{"id":"6469b06d-ac2c-32e6-8ef8-0a6e7a7c2beb","vendor":{"name":"surrealdb"}}]}},{"id":"c5c96fc8-eb2b-3819-80e3-c83c4f1778d3","vulnerability":{"id":"GHSA-7wmw-j7vc-669r","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","datePublished":"Nov 3, 2026, 3:32:10 PM","dateUpdated":"Nov 3, 2026, 3:32:10 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121417\nhttps://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a\nhttps://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends\n","enisa_id":"EUVD-2026-115949\n","aliases":"CVE-2026-121417\nGHSA-7wmw-j7vc-669r\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}