CVE-2025-71395

SurrealDB before 2.2.2 Memory Exhaustion via string::replace

State: Published
Severity: 7.1 High
Published: Jul 18, 2026
Updated: Oct 29, 2026
Reserved: Jul 16, 2026

Description

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-789 Memory Allocation with Excessive Size Value

Affected Products

Product	Versions
surrealdbsurrealdb	2.2.0 to before 2.2.2Affected 2.2.2Not affected
surrealdbsurrealdb	2.1.0 to before 2.1.5Affected 2.1.5Not affected
surrealdbsurrealdb	before 2.0.5Affected 2.0.5Not affected

References

GitHub Security Advisory (GHSA-3633-g6mg-p6qq)vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 Memory Exhaustion via string::replacethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.