CVE-2025-71393

SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions

State: Published
Severity: 6.0 Medium
Published: Jul 18, 2026
Updated: Oct 29, 2026
Reserved: Jul 16, 2026

Description

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-674 Uncontrolled Recursion

Affected Products

Product	Versions
surrealdbsurrealdb	2.2.0 to before 2.2.2Affected 2.2.2Not affected
surrealdbsurrealdb	2.1.0 to before 2.1.5Affected 2.1.5Not affected
surrealdbsurrealdb	before 2.0.5Affected 2.0.5Not affected

References

GitHub Security Advisory (GHSA-m7rc-8w7m-r9qr)vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 Memory Exhaustion via Nested Functionsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.