CVE-2025-71391 | SurrealDB versions before 2.2.2 contain an uncaught exceptio… | CVSS 7.1 HIGH

Description

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

Metadata

CVE ID: CVE-2025-71391
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-16 12:14 UTC
Published: 2026-07-18 13:10 UTC
Last updated: 2026-07-18 13:10 UTC
Primary CWE: CWE-248
Uncaught Exception
Vendor / Product: surrealdb / surrealdb
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products (3)

Vendor	Product	Platform	Versions
surrealdb	surrealdb	—	0 < 2.2.2, 2.2.2
surrealdb	surrealdb	—	0 < 2.1.5, 2.1.5
surrealdb	surrealdb	—	0 < 2.0.5, 2.0.5

Weakness (CWE)

CWE	Source	Description
CWE-248	cna	Uncaught Exception

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-rq86-9m6r-cm3g) https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g
VulnCheck Advisory: SurrealDB before 2.2.2 Denial of Service via /sql endpoint https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-sql-endpoint