{"id":"CVE-2026-121417","aliases":["EUVD-2026-115949","GHSA-7wmw-j7vc-669r","GHSA-pm86-cc75-q463","RUSTSEC-2026-0453"],"status":"published","title":"SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.002,"percentile":0.10013,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-10-19T12:00:00Z","modified":"2026-11-06T15:45:02Z","fixes":[{"ecosystem":"crates.io","package":"surrealdb","fixed_in":["3.3.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"surrealdb","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"3.3.0"}]}]}],"products":[{"vendor":"surrealdb","product":"surrealdb"}],"references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463","tags":["vendor-advisory","exploit","advisory"]},{"url":"https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a","tags":["patch","fix"]},{"url":"https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121417","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7wmw-j7vc-669r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121417.json","tags":["advisory"]},{"url":"https://crates.io/crates/surrealdb","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0453.html","tags":["advisory"]},{"url":"https://github.com/surrealdb/surrealdb/commit/8156ff691b1861814199e5e3372c81609b68db7f","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-121417","title":"SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","status":"published","published":"2026-11-03T14:28:15.135Z","modified":"2026-11-03T17:06:36.341Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-03T19:01:22.66055Z"}],"euvd":[{"id":"EUVD-2026-115949","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","status":"published","published":"2026-11-03T14:28:15Z","modified":"2026-11-03T17:06:36Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-03T18:19:04.249016Z"}],"ghsa":[{"id":"GHSA-7wmw-j7vc-669r","title":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that...","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","status":"published","published":"2026-11-03T15:32:10Z","modified":"2026-11-03T15:32:10Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-03T15:57:23.404697Z"}],"nvd":[{"id":"CVE-2026-121417","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","status":"published","published":"2026-11-03T15:17:31.553Z","modified":"2026-11-03T17:18:08.963Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-03T20:18:19.129968Z"}],"osv":[{"id":"CVE-2026-121417","title":"SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends","description":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","status":"published","published":"2026-11-03T14:28:15.135Z","modified":"2026-11-06T15:55:56.754284946Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-06T16:28:46.165024Z"},{"id":"RUSTSEC-2026-0453","title":"Use-after-free in KV backends via leaked `affinitypool::spawn_local` future","description":"The `kv-mem`, `kv-surrealkv` and `kv-rocksdb` backends move non-`'static` borrowed state into affinity-pool closures through `affinitypool::spawn_local`: a `tokio::sync::MutexGuard\u003cOption\u003cTransactionInner\u003e\u003e`, `\u0026Transaction`, `\u0026mut ScanStateKeys/Vals`, `\u0026mut dyn KeyVisitor/ValVisitor`, `RwLockReadGuard`, and a `ReadOptions` holding a raw `rocksdb_snapshot_t*`. In `affinitypool 0.7.0` `spawn_local` is safe and erases the `'pool` lifetime via `async_task::Builder::spawn_unchecked`; the only thing keeping it sound is the `Drop` implementation of the returned future, which blocks until the worker stops using the borrows.\n\nSafe code can leak that future (`mem::forget`, `Box::leak`, `ManuallyDrop`, a reference cycle, or a leaked enclosing future). The borrows then end while the pool worker still uses them, producing a use-after-free on the transaction allocation; AddressSanitizer reports a read of freed mutex data and a write when the worker unlocks the freed `tokio::sync::Mutex` on the pool thread. No `unsafe` is required at the call site, and the affected methods include `count`, `keys`/`keysr`, `scan`/`scanr`, `compact`, shutdown, point reads and writes, and cursor iteration.\n\n3.3.0 upgrades to `affinitypool 0.8.0`, where `spawn_local` is an `unsafe` function and the caller must uphold the leak-freedom invariant (commit `8156ff69`).","status":"published","published":"2026-10-19T12:00:00Z","modified":"2026-11-06T15:55:56.754284946Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T16:28:46.165024Z"}]}}