CVE-2025-71390 | SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 … | CVSS 5.8 MEDIUM

Description

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

Metadata

CVE ID: CVE-2025-71390
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-16 12:14 UTC
Published: 2026-07-18 13:10 UTC
Last updated: 2026-07-18 13:10 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: surrealdb / surrealdb
Sources: cve.org · NVD

Severity & Metrics

5.8 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

Affected products (1)

Vendor	Product	Platform	Versions
surrealdb	surrealdb	—	0 < 2.3.6, 2.2.6, 2.3.6, 2.2.6

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.8	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

References (2)

GitHub Security Advisory (GHSA-m3c3-78fh-w3w7) https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7
VulnCheck Advisory: SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution