SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-121417 · CVE overview and exploitation status

EUVD-2026-115949

GHSA-7wmw-j7vc-669r

RUSTSEC-2026-0453

GHSA-pm86-cc75-q463

cve-program · CVE-2026-121417

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463
• https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a
• https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends

euvd · EUVD-2026-115949

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463
• https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a
• https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends

nvd · CVE-2026-121417

• https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463
• https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends

osv · RUSTSEC-2026-0453

• https://crates.io/crates/surrealdb
• https://rustsec.org/advisories/RUSTSEC-2026-0453.html
• https://github.com/surrealdb/surrealdb/commit/8156ff691b1861814199e5e3372c81609b68db7f

• Use-after-free in KV backends via leaked `affinitypool::spawn_local` future · Newly collected advisory · 6 Nov 2026
• SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends · Newly collected advisory · 3 Nov 2026