CVE-2025-71393 | SurrealDB before 2.2.2 with scripting enabled fails to prope… | CVSS 6.0 MEDIUM

Description

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

Metadata

CVE ID: CVE-2025-71393
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-16 12:14 UTC
Published: 2026-07-18 13:10 UTC
Last updated: 2026-07-18 13:10 UTC
Primary CWE: CWE-674
Uncontrolled Recursion
Vendor / Product: surrealdb / surrealdb
Sources: cve.org · NVD

Severity & Metrics

6.0 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products (3)

Vendor	Product	Platform	Versions
surrealdb	surrealdb	—	0 < 2.2.2, 2.2.2
surrealdb	surrealdb	—	0 < 2.1.5, 2.1.5
surrealdb	surrealdb	—	0 < 2.0.5, 2.0.5

Weakness (CWE)

CWE	Source	Description
CWE-674	cna	Uncontrolled Recursion

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.0	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-m7rc-8w7m-r9qr) https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr
VulnCheck Advisory: SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions