CVE-2025-71396

SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting

State: Published
Severity: 2.3 Low
Published: Jul 18, 2026
Updated: Oct 29, 2026
Reserved: Jul 16, 2026

Description

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
surrealdbsurrealdb	2.2.0 to before 2.2.2Affected 2.2.2Not affected
surrealdbsurrealdb	before 2.0.5Affected 2.0.5Not affected
surrealdbsurrealdb	2.1.0 to before 2.1.5Affected 2.1.5Not affected

References

GitHub Security Advisory (GHSA-3824-qmfq-2qv7)vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 Denial of Service via JavaScript Scriptingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.