CVE-2026-109338 | SurrealDB up to 3.2.x Embedded JavaScript getSetCookie denial of service

October 12, 2026 Yanac

A vulnerability identified as critical has been detected in SurrealDB up to 3.2.x. This vulnerability affects the function getSetCookie of the component Embedded JavaScript. The manipulation leads to denial of service.

This vulnerability is uniquely identified as CVE-2026-109338. The attack is possible to be carried out remotely. No exploit exists.

You should upgrade the affected component.VulDB Recent EntriesRead More