CVE-2025-71393

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr	Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:surrealdb:surrealdb::::::::
	cpe:2.3:a:surrealdb:surrealdb::::::::
	cpe:2.3:a:surrealdb:surrealdb::::::::

History

29 Sep 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SurrealDB anterior a 2.2.2 con scripting habilitado no aplica correctamente los límites de recursión cuando las funciones nativas contienen JavaScript incrustado que emite nuevas consultas. Atacantes autenticados pueden eludir el límite de recursión encadenando llamadas a funciones nativas y JavaScript para desencadenar recursión infinita y agotar la memoria del servidor.

Information

Published : 2026-07-18 14:17

Updated : 2026-10-29 21:17

NVD link : CVE-2025-71393

Mitre link : CVE-2025-71393

CVE.ORG link : CVE-2025-71393

JSON object : View

Products Affected

surrealdb

surrealdb

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2025-71393", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71393", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T17:02:48.522453Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "2.2.2", "versionType": "semver"}, {"status": "unaffected", "version": "2.2.2", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "2.1.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.5", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.5", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}]}], "published": "2026-07-18T14:17:10.703", "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory."}, {"lang": "es", "value": "SurrealDB anterior a 2.2.2 con scripting habilitado no aplica correctamente los l\u00edmites de recursi\u00f3n cuando las funciones nativas contienen JavaScript incrustado que emite nuevas consultas. Atacantes autenticados pueden eludir el l\u00edmite de recursi\u00f3n encadenando llamadas a funciones nativas y JavaScript para desencadenar recursi\u00f3n infinita y agotar la memoria del servidor."}], "lastModified": "2026-10-29T21:17:05.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8978D31-3395-4155-8DFF-99FED3F8D7DA", "versionEndExcluding": "2.0.5"}, {"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D7A2AEC-83EE-46CC-BC91-D5EA1B841E96", "versionEndExcluding": "2.1.5", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4D2EDCC-A5D1-477A-ADA9-A32389A7D0BE", "versionEndExcluding": "2.2.2", "versionStartIncluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}