CVE-2025-71393

EUVD-2025-210484
SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.55%
Affected Products (NVD)
VendorProductVersion
surrealdbsurrealdb
𝑥
< 2.0.5
surrealdbsurrealdb
2.1.0 ≤
𝑥
< 2.1.5
surrealdbsurrealdb
2.2.0 ≤
𝑥
< 2.2.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr
https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions