CVE-2025-71391

SurrealDB before 2.2.2 Denial of Service via /sql endpoint

State: Published
Severity: 7.1 High
Published: Jul 18, 2026
Updated: Oct 29, 2026
Reserved: Jul 16, 2026

Description

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-248 Uncaught Exception

Affected Products

Product	Versions
surrealdbsurrealdb	2.2.0 to before 2.2.2Affected 2.2.2Not affected
surrealdbsurrealdb	2.1.0 to before 2.1.5Affected 2.1.5Not affected
surrealdbsurrealdb	before 2.0.5Affected 2.0.5Not affected

References

GitHub Security Advisory (GHSA-rq86-9m6r-cm3g)vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 Denial of Service via /sql endpointthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.