CVE-2025-71397

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf	Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-cpu-exhaustion-via-nested-for-loops	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:surrealdb:surrealdb::::::::
	cpe:2.3:a:surrealdb:surrealdb::::::::
	cpe:2.3:a:surrealdb:surrealdb::::::::

History

29 Sep 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SurrealDB antes de 2.0.5, 2.1.x antes de 2.1.5, y 2.2.x antes de 2.2.2 permite a usuarios autenticados con permisos de PROPIETARIO o EDITOR (a nivel de raíz, espacio de nombres o base de datos) definir funciones personalizadas de base de datos a través de DEFINE FUNCTION usando bucles FOR anidados. Aunque el recuento de iteraciones de un solo bucle está restringido, el anidamiento de múltiples bucles (por ejemplo, cada uno con 1.000.000 de iteraciones) no lo está, por lo que un atacante puede ejecutar una función que consume todo el tiempo de CPU del servidor. Los tiempos de espera configurados no detienen la ejecución, dejando al servidor sin respuesta a otras consultas y conexiones hasta que se reinicia manualmente.

Information

Published : 2026-07-18 14:17

Updated : 2026-10-29 21:17

NVD link : CVE-2025-71397

Mitre link : CVE-2025-71397

CVE.ORG link : CVE-2025-71397

JSON object : View

Products Affected

surrealdb

surrealdb

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2025-71397", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71397", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T15:12:40.333706Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "2.2.2", "versionType": "semver"}, {"status": "unaffected", "version": "2.2.2", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "2.1.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.5", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.5", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.5", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}]}], "published": "2026-07-18T14:17:11.220", "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/surrealdb-before-cpu-exhaustion-via-nested-for-loops", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted."}, {"lang": "es", "value": "SurrealDB antes de 2.0.5, 2.1.x antes de 2.1.5, y 2.2.x antes de 2.2.2 permite a usuarios autenticados con permisos de PROPIETARIO o EDITOR (a nivel de ra\u00edz, espacio de nombres o base de datos) definir funciones personalizadas de base de datos a trav\u00e9s de DEFINE FUNCTION usando bucles FOR anidados. Aunque el recuento de iteraciones de un solo bucle est\u00e1 restringido, el anidamiento de m\u00faltiples bucles (por ejemplo, cada uno con 1.000.000 de iteraciones) no lo est\u00e1, por lo que un atacante puede ejecutar una funci\u00f3n que consume todo el tiempo de CPU del servidor. Los tiempos de espera configurados no detienen la ejecuci\u00f3n, dejando al servidor sin respuesta a otras consultas y conexiones hasta que se reinicia manualmente."}], "lastModified": "2026-10-29T21:17:06.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8978D31-3395-4155-8DFF-99FED3F8D7DA", "versionEndExcluding": "2.0.5"}, {"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D7A2AEC-83EE-46CC-BC91-D5EA1B841E96", "versionEndExcluding": "2.1.5", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4D2EDCC-A5D1-477A-ADA9-A32389A7D0BE", "versionEndExcluding": "2.2.2", "versionStartIncluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}