ETK-2026-3382Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3382",
  "cve_id": null,
  "display_id": "ETK-2026-3382",
  "ghsa_id": "GHSA-p3c2-wh5f-jwqm",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "GraphQL WebSocket resource exhaustion in SurrealDB",
  "summary": "SurrealDB versions before 4.0.0 do not apply configured WebSocket size and buffer limits to the GraphQL WebSocket endpoint. An unauthenticated network client can consume server memory and degrade availability by opening GraphQL WebSocket connections when GraphQL is enabled for a database.",
  "mitigation": "Upgrade SurrealDB to version 4.0.0. Until upgrading, disable the GraphQL HTTP endpoint or block access to its WebSocket route at a reverse proxy.",
  "vendor": "rust",
  "product": "surrealdb",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 4.0.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [
        "4.0.0"
      ],
      "package_name": "surrealdb",
      "purl": "pkg:cargo/surrealdb"
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 17.5972757,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-11-03T16:58:49.641088+00:00",
      "days": -0.15849296577546296,
      "is_lower_bound": true,
      "measured_at": "2026-11-03T20:47:03.557737+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-03T15:51:06+00:00",
      "days": -0.20552584873842591,
      "is_lower_bound": true,
      "measured_at": "2026-11-03T20:47:03.557737+00:00",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-p3c2-wh5f-jwqm"
    }
  }
}